feat: more input parameters validations

jans-fido2/server/src/main/java/io/jans/fido2/service/persist/UserSessionIdService.java

@@ -30,6 +30,8 @@
 @ApplicationScoped
 public class UserSessionIdService {
 
+	public static final String AUTHENTICATED_USER = "auth_user";
+
     @Inject
     private Logger log;
 
@@ -39,6 +41,24 @@ public class UserSessionIdService {
     @Inject
     private PersistenceEntryManager persistenceEntryManager;
 
+    public boolean isValidSessionId(String sessionId, String userName) {
+        SessionId session = getSessionId(sessionId);
+        if (session == null) {
+            log.error("Specified session_id '{}' is invalid", sessionId);
+            return false;
+        }
+
+        if (StringHelper.isNotEmpty(userName)) {
+	        String sessionIdUser = session.getSessionAttributes().get(AUTHENTICATED_USER);
+	        if (!StringHelper.equalsIgnoreCase(userName, sessionIdUser)) {
+	            log.error("Username '{}' and session_id '{}' don't match", userName, sessionId);
+	            return false;
+	        }
+        }
+
+        return true;
+    }
+
     public void updateUserSessionIdOnFinishRequest(String sessionId, String userInum, Fido2RegistrationEntry registrationEntry, boolean enroll, boolean oneStep) {
         SessionId entity = getSessionId(sessionId);
         if (entity == null) {

jans-fido2/server/src/main/java/io/jans/fido2/service/sg/converter/AssertionSuperGluuController.java

@@ -24,6 +24,7 @@
 import io.jans.fido2.service.DataMapperService;
 import io.jans.fido2.service.DigestService;
 import io.jans.fido2.service.operation.AssertionService;
+import io.jans.fido2.service.persist.UserSessionIdService;
 import io.jans.fido2.service.sg.RawAuthenticationService;
 import io.jans.fido2.service.verifier.CommonVerifiers;
 import io.jans.fido2.sg.SuperGluuMode;
@@ -54,6 +55,9 @@ public class AssertionSuperGluuController {
 	@Inject
 	private DigestService digestService;
 
+	@Inject
+	private UserSessionIdService userSessionIdService;
+
     /* Example for one_step:
      *  - request:
      *             username: null
@@ -79,6 +83,15 @@ public class AssertionSuperGluuController {
     public JsonNode startAuthentication(String userName, String keyHandle, String appId, String sessionId) {
         boolean oneStep = StringHelper.isEmpty(userName);
 
+        boolean valid = userSessionIdService.isValidSessionId(sessionId, userName);
+        if (!valid) {
+            throw new Fido2RuntimeException(String.format("session_id '%s' is invalid", sessionId));
+        }
+
+        if (StringHelper.isEmpty(userName) && StringHelper.isEmpty(keyHandle)) {
+            throw new Fido2RuntimeException("The request should contains either username or keyhandle");
+        }
+
         ObjectNode params = dataMapperService.createObjectNode();
         // Add all required parameters from request to allow process U2F request 
         params.put(CommonVerifiers.SUPER_GLUU_REQUEST, true);

jans-fido2/server/src/main/java/io/jans/fido2/service/sg/converter/AttestationSuperGluuController.java

@@ -30,6 +30,7 @@
 import io.jans.fido2.service.DataMapperService;
 import io.jans.fido2.service.DigestService;
 import io.jans.fido2.service.operation.AttestationService;
+import io.jans.fido2.service.persist.UserSessionIdService;
 import io.jans.fido2.service.sg.RawRegistrationService;
 import io.jans.fido2.service.verifier.CommonVerifiers;
 import io.jans.fido2.sg.SuperGluuMode;
@@ -70,6 +71,9 @@ public class AttestationSuperGluuController {
 	@Inject
 	private DigestService digestService;
 
+	@Inject
+	private UserSessionIdService userSessionIdService;
+
     @Inject
     private AppConfiguration appConfiguration;
 
@@ -96,6 +100,11 @@ public class AttestationSuperGluuController {
     public JsonNode startRegistration(String userName, String appId, String sessionId, String enrollmentCode) {
         boolean oneStep = StringHelper.isEmpty(userName);
 
+        boolean valid = userSessionIdService.isValidSessionId(sessionId, userName);
+        if (!valid) {
+            throw new Fido2RuntimeException(String.format("session_id '%s' is invalid", sessionId));
+        }
+
         ObjectNode params = dataMapperService.createObjectNode();
         // Add all required parameters from request to allow process U2F request 
         params.put(CommonVerifiers.SUPER_GLUU_MODE, oneStep ? SuperGluuMode.ONE_STEP.getMode() : SuperGluuMode.TWO_STEP.getMode());
@@ -105,12 +114,12 @@ public JsonNode startRegistration(String userName, String appId, String sessionI
         if (oneStep) {
         	useUserName = attestationService.generateUserId();
         }
-        
+
         params.put("username", useUserName);
         params.put("displayName", useUserName);
 
         params.put("session_id", sessionId);
-
+        
         // Required parameters
         params.put("attestation", "direct");