Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Tn/use new authn lib #801

Merged
merged 2 commits into from
Apr 17, 2023
Merged

Tn/use new authn lib #801

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
374e9e3
use new library
TylerNoblett Mar 28, 2023
b3f09a4
upgrad to match new library spec
TylerNoblett Mar 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion backend/authschemes/webauthn/session.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ package webauthn
import (
"encoding/gob"

auth "github.com/duo-labs/webauthn/webauthn"
auth "github.com/go-webauthn/webauthn/webauthn"
)

type webAuthNSessionData struct {
Expand Down
2 changes: 1 addition & 1 deletion backend/authschemes/webauthn/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ package webauthn
import (
"time"

auth "github.com/duo-labs/webauthn/webauthn"
auth "github.com/go-webauthn/webauthn/webauthn"
)

type RegistrationType int
Expand Down
4 changes: 2 additions & 2 deletions backend/authschemes/webauthn/webauthn.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@ import (
"github.com/theparanoids/ashirt-server/backend/server/middleware"
"github.com/theparanoids/ashirt-server/backend/server/remux"

"github.com/duo-labs/webauthn/protocol"
auth "github.com/duo-labs/webauthn/webauthn"
"github.com/go-webauthn/webauthn/protocol"
auth "github.com/go-webauthn/webauthn/webauthn"
)

type WebAuthn struct {
Expand Down
2 changes: 1 addition & 1 deletion backend/authschemes/webauthn/webauthnuser.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import (
"strings"
"time"

auth "github.com/duo-labs/webauthn/webauthn"
auth "github.com/go-webauthn/webauthn/webauthn"
"github.com/google/uuid"
"github.com/theparanoids/ashirt-server/backend/helpers"
)
Expand Down
2 changes: 1 addition & 1 deletion backend/config/authconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import (
"os"
"strings"

"github.com/duo-labs/webauthn/protocol"
"github.com/go-webauthn/webauthn/protocol"
"github.com/kelseyhightower/envconfig"
"github.com/theparanoids/ashirt-server/backend/helpers"
)
Expand Down
23 changes: 21 additions & 2 deletions frontend/src/authschemes/webauthn/helpers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,25 @@ export const toKeycode = (c: string) => c.charCodeAt(0)

export const toByteArray = (s: string) => Uint8Array.from(atob(s), toKeycode)

const base64UrlToBase64 = (input: string) => {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the only substantial change is the the 'challenge' string is now being sent in base64url (which is just base 64 but url safe; – is used instead of + and _ is used instead of /) and there are some padding differences

// Replace non-url compatible chars with base64 standard chars
let standardCharInput = input
.replace(/-/g, '+')
.replace(/_/g, '/');

// Pad out with standard base64 required padding characters
const pad = standardCharInput.length % 4;
if(pad) {
if(pad === 1) {
throw new Error('InvalidLengthError: Input base64url string is the wrong length to determine padding');
}
standardCharInput += new Array(5-pad).join('=');
}
return standardCharInput;
}

export const toByteArrayFromB64URL = (s: string) => Uint8Array.from(atob(base64UrlToBase64(s)), toKeycode)

export const convertToCredentialCreationOptions = (
input: ProvidedCredentialCreationOptions
): CredentialCreationOptions => {
Expand All @@ -30,7 +49,7 @@ export const convertToCredentialCreationOptions = (
...input,
publicKey: {
...input.publicKey,
challenge: toByteArray(input.publicKey.challenge),
challenge: toByteArrayFromB64URL(input.publicKey.challenge),
user: {
...input.publicKey.user,
id: toByteArray(input.publicKey.user.id)
Expand All @@ -47,7 +66,7 @@ export const convertToCredentialCreationOptions = (
export const convertToPublicKeyCredentialRequestOptions = (input: ProvidedCredentialRequestOptions): PublicKeyCredentialRequestOptions => {
const output: PublicKeyCredentialRequestOptions = {
...input.publicKey,
challenge: toByteArray(input.publicKey.challenge),
challenge: toByteArrayFromB64URL(input.publicKey.challenge),
allowCredentials: input.publicKey.allowCredentials.map(
listItem => ({ ...listItem, id: toByteArray(listItem.id) })
)
Expand Down
64 changes: 7 additions & 57 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ require (
github.com/Masterminds/squirrel v1.5.3
github.com/aws/aws-sdk-go v1.44.211
github.com/coreos/go-oidc/v3 v3.5.0
github.com/duo-labs/webauthn v0.0.0-20220330035159-03696f3d4499
github.com/go-kit/kit v0.12.0
github.com/go-sql-driver/mysql v1.7.0
github.com/go-webauthn/webauthn v0.8.2
github.com/google/uuid v1.3.0
github.com/gorilla/csrf v1.7.1
github.com/gorilla/mux v1.8.0
Expand All @@ -35,98 +35,48 @@ require (
cloud.google.com/go/compute/metadata v0.2.3 // indirect
cloud.google.com/go/iam v0.8.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bgentry/speakeasy v0.1.0 // indirect
github.com/boombuler/barcode v1.0.1 // indirect
github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/cloudflare/cfssl v1.6.1 // indirect
github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1 // indirect
github.com/coreos/go-semver v0.3.0 // indirect
github.com/coreos/go-systemd/v22 v22.3.2 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/dustin/go-humanize v1.0.0 // indirect
github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
github.com/envoyproxy/protoc-gen-validate v0.6.1 // indirect
github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect
github.com/fullstorydev/grpcurl v1.8.1 // indirect
github.com/fxamacker/cbor/v2 v2.4.0 // indirect
github.com/go-gorp/gorp/v3 v3.0.5 // indirect
github.com/go-jose/go-jose/v3 v3.0.0 // indirect
github.com/go-kit/log v0.2.0 // indirect
github.com/go-logfmt/logfmt v0.5.1 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.1.0 // indirect
github.com/go-webauthn/revoke v0.1.9 // indirect
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/mock v1.6.0 // indirect
github.com/golang/protobuf v1.5.2 // indirect
github.com/google/btree v1.0.1 // indirect
github.com/google/certificate-transparency-go v1.1.2-0.20210511102531-373a877eec92 // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/google/go-tpm v0.3.3 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.1 // indirect
github.com/googleapis/gax-go/v2 v2.7.0 // indirect
github.com/gorilla/websocket v1.4.2 // indirect
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
github.com/inconshreveable/mousetrap v1.0.0 // indirect
github.com/jhump/protoreflect v1.8.2 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
github.com/mattn/go-runewidth v0.0.13 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
github.com/mitchellh/mapstructure v1.4.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/olekukonko/tablewriter v0.0.5 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/common v0.37.0 // indirect
github.com/prometheus/procfs v0.8.0 // indirect
github.com/rivo/uniseg v0.2.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/sirupsen/logrus v1.8.1 // indirect
github.com/soheilhy/cmux v0.1.5 // indirect
github.com/spf13/cobra v1.2.1 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
github.com/urfave/cli v1.22.5 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
go.etcd.io/bbolt v1.3.5 // indirect
go.etcd.io/etcd/api/v3 v3.5.0 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.0 // indirect
go.etcd.io/etcd/client/v2 v2.305.0 // indirect
go.etcd.io/etcd/client/v3 v3.5.0 // indirect
go.etcd.io/etcd/etcdctl/v3 v3.5.0-alpha.0 // indirect
go.etcd.io/etcd/pkg/v3 v3.5.0-alpha.0 // indirect
go.etcd.io/etcd/raft/v3 v3.5.0-alpha.0 // indirect
go.etcd.io/etcd/server/v3 v3.5.0-alpha.0 // indirect
go.etcd.io/etcd/tests/v3 v3.5.0-alpha.0 // indirect
go.etcd.io/etcd/v3 v3.5.0-alpha.0 // indirect
go.opencensus.io v0.24.0 // indirect
go.uber.org/atomic v1.9.0 // indirect
go.uber.org/multierr v1.7.0 // indirect
go.uber.org/zap v1.19.1 // indirect
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
golang.org/x/net v0.7.0 // indirect
golang.org/x/sys v0.5.0 // indirect
golang.org/x/text v0.7.0 // indirect
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
golang.org/x/tools v0.1.12 // indirect
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
google.golang.org/api v0.106.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
google.golang.org/grpc v1.51.0 // indirect
google.golang.org/protobuf v1.28.1 // indirect
gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
sigs.k8s.io/yaml v1.2.0 // indirect
)

// replace github.com/go-webauthn/webauthn => ./webauthn
Loading