1049 lines
33 KiB
Go
Vendored
1049 lines
33 KiB
Go
Vendored
package webauthn
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/mock/gomock"
|
|
|
|
"github.com/go-webauthn/webauthn/metadata"
|
|
"github.com/go-webauthn/webauthn/protocol"
|
|
"github.com/go-webauthn/webauthn/protocol/webauthncose"
|
|
"github.com/go-webauthn/webauthn/testing/mocks"
|
|
)
|
|
|
|
func TestWithRegistrationRelyingPartyID(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
have *Config
|
|
opts []RegistrationOption
|
|
expectedID string
|
|
expectedName string
|
|
err string
|
|
}{
|
|
{
|
|
name: "OptionDefinedInConfig",
|
|
have: &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
},
|
|
opts: nil,
|
|
expectedID: "example.com",
|
|
expectedName: "Test Display Name",
|
|
},
|
|
{
|
|
name: "OptionDefinedInConfigAndOpts",
|
|
have: &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
},
|
|
opts: []RegistrationOption{WithRegistrationRelyingPartyID("a.example.com"), WithRegistrationRelyingPartyName("Test Display Name2")},
|
|
expectedID: "a.example.com",
|
|
expectedName: "Test Display Name2",
|
|
},
|
|
{
|
|
name: "OptionDefinedInConfigWithNoErrAndInOptsWithError",
|
|
have: &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
},
|
|
opts: []RegistrationOption{WithRegistrationRelyingPartyID("---::~!!~@#M!@OIK#N!@IOK@@@@@@@@@@"), WithRegistrationRelyingPartyName("Test Display Name2")},
|
|
err: "error generating credential creation: the relying party id failed to validate as it's not a valid domain string with error: parse \"---::~!!~@\": first path segment in URL cannot contain colon",
|
|
},
|
|
{
|
|
name: "OptionDefinedInOpts",
|
|
have: &Config{
|
|
RPOrigins: []string{"example.com"},
|
|
},
|
|
opts: []RegistrationOption{WithRegistrationRelyingPartyID("example.com"), WithRegistrationRelyingPartyName("Test Display Name")},
|
|
expectedID: "example.com",
|
|
expectedName: "Test Display Name",
|
|
},
|
|
{
|
|
name: "OptionDisplayNameNotDefined",
|
|
have: &Config{
|
|
RPOrigins: []string{"https://example.com"},
|
|
},
|
|
opts: []RegistrationOption{WithRegistrationRelyingPartyID("example.com")},
|
|
err: "error generating credential creation: the relying party display name must be provided via the configuration or a functional option for a creation",
|
|
},
|
|
{
|
|
name: "OptionIDNotDefined",
|
|
have: &Config{
|
|
RPOrigins: []string{"https://example.com"},
|
|
},
|
|
opts: []RegistrationOption{WithRegistrationRelyingPartyName("Test Display Name")},
|
|
err: "error generating credential creation: the relying party id must be provided via the configuration or a functional option for a creation",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
w, err := New(tc.have)
|
|
assert.NoError(t, err)
|
|
|
|
user := &defaultUser{}
|
|
|
|
creation, _, err := w.BeginRegistration(user, tc.opts...)
|
|
if tc.err != "" {
|
|
assert.EqualError(t, err, tc.err)
|
|
} else {
|
|
assert.NoError(t, err)
|
|
require.NotNil(t, creation)
|
|
assert.Equal(t, tc.expectedID, creation.Response.RelyingParty.ID)
|
|
assert.Equal(t, tc.expectedName, creation.Response.RelyingParty.Name)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRegistration_FinishRegistrationFailure(t *testing.T) {
|
|
user := &defaultUser{
|
|
id: []byte("123"),
|
|
}
|
|
|
|
session := SessionData{
|
|
UserID: []byte("ABC"),
|
|
}
|
|
|
|
webauthn := &WebAuthn{}
|
|
|
|
credential, err := webauthn.FinishRegistration(user, session, nil)
|
|
if err == nil {
|
|
t.Errorf("FinishRegistration() error = nil, want %v", protocol.ErrBadRequest.Type)
|
|
}
|
|
|
|
if credential != nil {
|
|
t.Errorf("FinishRegistration() credential = %v, want nil", credential)
|
|
}
|
|
}
|
|
|
|
func TestEntityEncoding(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
b64 bool
|
|
have, expected string
|
|
}{
|
|
{"ShouldEncodeBase64", true, "abc", `{"name":"","displayName":"","id":"YWJj"}`},
|
|
{"ShouldEncodeString", false, "abc", `{"name":"","displayName":"","id":"abc"}`},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
entityUser := protocol.UserEntity{}
|
|
|
|
if tc.b64 {
|
|
entityUser.ID = protocol.URLEncodedBase64(tc.have)
|
|
} else {
|
|
entityUser.ID = tc.have
|
|
}
|
|
|
|
data, err := json.Marshal(entityUser)
|
|
|
|
assert.NoError(t, err)
|
|
|
|
assert.Equal(t, tc.expected, string(data))
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCreateCredential_Errors(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
user User
|
|
session SessionData
|
|
err string
|
|
}{
|
|
{
|
|
name: "ShouldFailUserIDMismatch",
|
|
user: &defaultUser{
|
|
id: []byte("123"),
|
|
},
|
|
session: SessionData{
|
|
UserID: []byte("456"),
|
|
},
|
|
err: "ID mismatch for User and Session",
|
|
},
|
|
{
|
|
name: "ShouldFailSessionExpired",
|
|
user: &defaultUser{
|
|
id: []byte("123"),
|
|
},
|
|
session: SessionData{
|
|
UserID: []byte("123"),
|
|
Expires: time.Now().Add(-time.Hour),
|
|
},
|
|
err: "Session has Expired",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
w := &WebAuthn{Config: &Config{
|
|
RPID: "example.com",
|
|
RPOrigins: []string{"https://example.com"},
|
|
}}
|
|
|
|
credential, err := w.CreateCredential(tc.user, tc.session, nil)
|
|
assert.Nil(t, credential)
|
|
assert.EqualError(t, err, tc.err)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestBeginRegistration_Timeouts(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
config *Config
|
|
opts []RegistrationOption
|
|
expectedTimeout int
|
|
}{
|
|
{
|
|
name: "ShouldUseDefaultTimeout",
|
|
config: &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
},
|
|
expectedTimeout: 300000,
|
|
},
|
|
{
|
|
name: "ShouldUseUVDTimeout",
|
|
config: &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
AuthenticatorSelection: protocol.AuthenticatorSelection{
|
|
UserVerification: protocol.VerificationDiscouraged,
|
|
},
|
|
},
|
|
expectedTimeout: 120000,
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
w, err := New(tc.config)
|
|
require.NoError(t, err)
|
|
|
|
user := &defaultUser{id: []byte("123")}
|
|
|
|
creation, _, err := w.BeginRegistration(user, tc.opts...)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, tc.expectedTimeout, creation.Response.Timeout)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestBeginRegistration_EncodeUserIDAsString(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
encodeAsString bool
|
|
userID string
|
|
expectedIDType string
|
|
}{
|
|
{
|
|
name: "ShouldEncodeAsBase64",
|
|
encodeAsString: false,
|
|
userID: "testuser",
|
|
expectedIDType: "protocol.URLEncodedBase64",
|
|
},
|
|
{
|
|
name: "ShouldEncodeAsString",
|
|
encodeAsString: true,
|
|
userID: "testuser",
|
|
expectedIDType: "string",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
config := &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
EncodeUserIDAsString: tc.encodeAsString,
|
|
}
|
|
|
|
w, err := New(config)
|
|
require.NoError(t, err)
|
|
|
|
user := &defaultUser{id: []byte(tc.userID)}
|
|
|
|
creation, _, err := w.BeginRegistration(user)
|
|
require.NoError(t, err)
|
|
|
|
if tc.encodeAsString {
|
|
_, ok := creation.Response.User.ID.(string)
|
|
assert.True(t, ok)
|
|
} else {
|
|
_, ok := creation.Response.User.ID.(protocol.URLEncodedBase64)
|
|
assert.True(t, ok)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestBeginMediatedRegistration_ChallengeLength(t *testing.T) {
|
|
// withTestChallenge is a test-only RegistrationOption that overrides the generated challenge. It mirrors the
|
|
// WithChallenge login option; no equivalent is exported for registration, so we synthesise one here to exercise
|
|
// the minimum-length guard.
|
|
withTestChallenge := func(challenge []byte) RegistrationOption {
|
|
return func(cco *protocol.PublicKeyCredentialCreationOptions) {
|
|
cco.Challenge = challenge
|
|
}
|
|
}
|
|
|
|
config := &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
}
|
|
|
|
testCases := []struct {
|
|
name string
|
|
opts []RegistrationOption
|
|
expLen int
|
|
err string
|
|
}{
|
|
{
|
|
name: "ShouldSucceedWithDefaultChallenge",
|
|
opts: nil,
|
|
expLen: 32,
|
|
},
|
|
{
|
|
name: "ShouldFailNilChallenge",
|
|
opts: []RegistrationOption{withTestChallenge(nil)},
|
|
err: "error generating credential creation: the challenge must be at least 16 bytes",
|
|
},
|
|
{
|
|
name: "ShouldFailEmptyChallenge",
|
|
opts: []RegistrationOption{withTestChallenge([]byte{})},
|
|
err: "error generating credential creation: the challenge must be at least 16 bytes",
|
|
},
|
|
{
|
|
name: "ShouldFailEightByteChallenge",
|
|
opts: []RegistrationOption{withTestChallenge(bytes.Repeat([]byte{0xab}, 8))},
|
|
err: "error generating credential creation: the challenge must be at least 16 bytes",
|
|
},
|
|
{
|
|
name: "ShouldFailFifteenByteChallenge",
|
|
opts: []RegistrationOption{withTestChallenge(bytes.Repeat([]byte{0xab}, 15))},
|
|
err: "error generating credential creation: the challenge must be at least 16 bytes",
|
|
},
|
|
{
|
|
name: "ShouldSucceedSixteenByteChallenge",
|
|
opts: []RegistrationOption{withTestChallenge(bytes.Repeat([]byte{0xab}, 16))},
|
|
expLen: 16,
|
|
},
|
|
{
|
|
name: "ShouldSucceedThirtyTwoByteChallenge",
|
|
opts: []RegistrationOption{withTestChallenge(bytes.Repeat([]byte{0xab}, 32))},
|
|
expLen: 32,
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
w, err := New(config)
|
|
require.NoError(t, err)
|
|
|
|
user := &defaultUser{id: []byte("123")}
|
|
|
|
creation, session, err := w.BeginMediatedRegistration(user, protocol.MediationDefault, tc.opts...)
|
|
|
|
if tc.err != "" {
|
|
assert.EqualError(t, err, tc.err)
|
|
assert.Nil(t, creation)
|
|
assert.Nil(t, session)
|
|
|
|
return
|
|
}
|
|
|
|
require.NoError(t, err)
|
|
require.NotNil(t, creation)
|
|
require.NotNil(t, session)
|
|
assert.Len(t, []byte(creation.Response.Challenge), tc.expLen)
|
|
assert.NotEmpty(t, session.Challenge)
|
|
assert.Equal(t, creation.Response.Challenge.String(), session.Challenge)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestBeginMediatedRegistration_EnforceTimeout(t *testing.T) {
|
|
config := &Config{
|
|
RPID: "example.com",
|
|
RPDisplayName: "Test Display Name",
|
|
RPOrigins: []string{"https://example.com"},
|
|
Timeouts: TimeoutsConfig{
|
|
Registration: TimeoutConfig{
|
|
Enforce: true,
|
|
Timeout: time.Second * 60,
|
|
},
|
|
},
|
|
}
|
|
|
|
w, err := New(config)
|
|
require.NoError(t, err)
|
|
|
|
user := &defaultUser{id: []byte("123")}
|
|
|
|
_, session, err := w.BeginMediatedRegistration(user, protocol.MediationConditional)
|
|
require.NoError(t, err)
|
|
assert.False(t, session.Expires.IsZero())
|
|
assert.Equal(t, protocol.MediationConditional, session.Mediation)
|
|
}
|
|
|
|
func TestRegistrationOptions(t *testing.T) {
|
|
tv := true
|
|
fv := false
|
|
|
|
testCases := []struct {
|
|
name string
|
|
opts []RegistrationOption
|
|
have protocol.PublicKeyCredentialCreationOptions
|
|
expected protocol.PublicKeyCredentialCreationOptions
|
|
}{
|
|
{
|
|
name: "Empty",
|
|
opts: nil,
|
|
},
|
|
{
|
|
name: "CredentialParametersDefault",
|
|
opts: []RegistrationOption{WithCredentialParameters(CredentialParametersDefault())},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
Parameters: CredentialParametersDefault(),
|
|
},
|
|
},
|
|
{
|
|
name: "CredentialParametersL3Extended",
|
|
opts: []RegistrationOption{WithCredentialParameters(CredentialParametersExtendedL3())},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
Parameters: CredentialParametersExtendedL3(),
|
|
},
|
|
},
|
|
{
|
|
name: "CredentialParametersL3Recommended",
|
|
opts: []RegistrationOption{WithCredentialParameters(CredentialParametersRecommendedL3())},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
Parameters: CredentialParametersRecommendedL3(),
|
|
},
|
|
},
|
|
{
|
|
name: "Exclusions",
|
|
opts: []RegistrationOption{WithExclusions([]protocol.CredentialDescriptor{{Type: protocol.PublicKeyCredentialType, CredentialID: []byte("123"), Transport: []protocol.AuthenticatorTransport{protocol.Hybrid}}})},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
CredentialExcludeList: []protocol.CredentialDescriptor{
|
|
{Type: protocol.PublicKeyCredentialType, CredentialID: []byte("123"), Transport: []protocol.AuthenticatorTransport{protocol.Hybrid}},
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "Selections",
|
|
opts: []RegistrationOption{WithAuthenticatorSelection(protocol.AuthenticatorSelection{
|
|
AuthenticatorAttachment: protocol.CrossPlatform,
|
|
RequireResidentKey: &tv,
|
|
ResidentKey: protocol.ResidentKeyRequirementRequired,
|
|
UserVerification: protocol.VerificationRequired,
|
|
})},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
AuthenticatorSelection: protocol.AuthenticatorSelection{
|
|
AuthenticatorAttachment: protocol.CrossPlatform,
|
|
RequireResidentKey: &tv,
|
|
ResidentKey: protocol.ResidentKeyRequirementRequired,
|
|
UserVerification: protocol.VerificationRequired,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "ResidentKeyRequirementRequired",
|
|
opts: []RegistrationOption{WithResidentKeyRequirement(protocol.ResidentKeyRequirementRequired)},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
AuthenticatorSelection: protocol.AuthenticatorSelection{
|
|
RequireResidentKey: &tv,
|
|
ResidentKey: protocol.ResidentKeyRequirementRequired,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "ResidentKeyRequirementPreferred",
|
|
opts: []RegistrationOption{WithResidentKeyRequirement(protocol.ResidentKeyRequirementPreferred)},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
AuthenticatorSelection: protocol.AuthenticatorSelection{
|
|
RequireResidentKey: &fv,
|
|
ResidentKey: protocol.ResidentKeyRequirementPreferred,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "PublicKeyCredentialHints",
|
|
opts: []RegistrationOption{WithPublicKeyCredentialHints([]protocol.PublicKeyCredentialHints{
|
|
protocol.PublicKeyCredentialHintSecurityKey,
|
|
})},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
Hints: []protocol.PublicKeyCredentialHints{
|
|
protocol.PublicKeyCredentialHintSecurityKey,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "ConveyancePreference",
|
|
opts: []RegistrationOption{WithConveyancePreference(protocol.PreferEnterpriseAttestation)},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
Attestation: protocol.PreferEnterpriseAttestation,
|
|
},
|
|
},
|
|
{
|
|
name: "AttestationFormats",
|
|
opts: []RegistrationOption{WithAttestationFormats([]protocol.AttestationFormat{protocol.AttestationFormatPacked})},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
AttestationFormats: []protocol.AttestationFormat{protocol.AttestationFormatPacked},
|
|
},
|
|
},
|
|
{
|
|
name: "Extensions",
|
|
opts: []RegistrationOption{WithExtensions(map[string]any{"appID": "example"})},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
Extensions: map[string]any{"appID": "example"},
|
|
},
|
|
},
|
|
{
|
|
name: "AppIDExcludeExtensionWithNoExclusions",
|
|
opts: []RegistrationOption{WithAppIdExcludeExtension("apple")},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{},
|
|
},
|
|
{
|
|
name: "AppIDExcludeExtensionWithExclusions",
|
|
opts: []RegistrationOption{WithExclusions([]protocol.CredentialDescriptor{
|
|
{Type: protocol.PublicKeyCredentialType, AttestationFormat: string(protocol.AttestationFormatFIDOUniversalSecondFactor), CredentialID: []byte("123"), Transport: []protocol.AuthenticatorTransport{protocol.Hybrid}},
|
|
}), WithAppIdExcludeExtension("apple")},
|
|
expected: protocol.PublicKeyCredentialCreationOptions{
|
|
CredentialExcludeList: []protocol.CredentialDescriptor{
|
|
{Type: protocol.PublicKeyCredentialType, AttestationFormat: string(protocol.AttestationFormatFIDOUniversalSecondFactor), CredentialID: []byte("123"), Transport: []protocol.AuthenticatorTransport{protocol.Hybrid}},
|
|
},
|
|
Extensions: map[string]any{"appidExclude": "apple"},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
opts := &tc.have
|
|
|
|
for _, opt := range tc.opts {
|
|
opt(opts)
|
|
}
|
|
|
|
assert.Equal(t, tc.expected, *opts)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCreateCredential_Full(t *testing.T) {
|
|
credParams := []protocol.CredentialParameter{{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgES256}}
|
|
|
|
testCases := []struct {
|
|
name string
|
|
have struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}
|
|
expected struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}
|
|
}{
|
|
{
|
|
name: "ShouldSucceedNoneFormat",
|
|
have: struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}{
|
|
specVector: testRegistrationSpecVectorNoneES256,
|
|
},
|
|
expected: struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}{
|
|
attestationType: "none",
|
|
attestationFormat: "none",
|
|
},
|
|
},
|
|
{
|
|
name: "ShouldSucceedPackedSelfFormat",
|
|
have: struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}{
|
|
specVector: testRegistrationSpecVectorPackedSelfES256,
|
|
},
|
|
expected: struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}{
|
|
attestationType: "basic_surrogate",
|
|
attestationFormat: "packed",
|
|
},
|
|
},
|
|
{
|
|
name: "ShouldSucceedWithMDS",
|
|
have: struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}{
|
|
specVector: testRegistrationSpecVectorPackedSelfES256,
|
|
setup: func(t *testing.T, provider *mocks.MockMetadataProvider) {
|
|
t.Helper()
|
|
|
|
provider.EXPECT().GetEntry(gomock.Any(), gomock.Any()).Return(nil, nil)
|
|
provider.EXPECT().GetValidateEntry(gomock.Any()).Return(false)
|
|
},
|
|
},
|
|
expected: struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}{
|
|
attestationType: "basic_surrogate",
|
|
attestationFormat: "packed",
|
|
},
|
|
},
|
|
{
|
|
name: "ShouldFailWithMDSGetEntryError",
|
|
have: struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}{
|
|
specVector: testRegistrationSpecVectorPackedSelfES256,
|
|
setup: func(t *testing.T, provider *mocks.MockMetadataProvider) {
|
|
t.Helper()
|
|
|
|
provider.EXPECT().GetEntry(gomock.Any(), gomock.Any()).Return(nil, fmt.Errorf("entry lookup failed"))
|
|
},
|
|
},
|
|
expected: struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}{
|
|
err: "Failed to validate authenticator metadata for Authenticator Attestation GUID 'df850e09-db6a-fbdf-ab51-697791506cfc'. Error occurred retrieving the metadata entry: entry lookup failed",
|
|
},
|
|
},
|
|
{
|
|
name: "ShouldSucceedWithMDSValidateStatusReports",
|
|
have: struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}{
|
|
specVector: testRegistrationSpecVectorPackedSelfES256,
|
|
setup: func(t *testing.T, provider *mocks.MockMetadataProvider) {
|
|
t.Helper()
|
|
|
|
provider.EXPECT().GetEntry(gomock.Any(), gomock.Any()).Return(&metadata.Entry{
|
|
MetadataStatement: metadata.Statement{
|
|
AttestationTypes: metadata.AuthenticatorAttestationTypes{metadata.BasicSurrogate},
|
|
},
|
|
}, nil)
|
|
provider.EXPECT().GetValidateAttestationTypes(gomock.Any()).Return(true)
|
|
provider.EXPECT().GetValidateStatus(gomock.Any()).Return(true)
|
|
provider.EXPECT().ValidateStatusReports(gomock.Any(), gomock.Any()).Return(nil)
|
|
provider.EXPECT().GetValidateTrustAnchor(gomock.Any()).Return(false)
|
|
},
|
|
},
|
|
expected: struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}{
|
|
attestationType: "basic_surrogate",
|
|
attestationFormat: "packed",
|
|
},
|
|
},
|
|
{
|
|
name: "ShouldFailVerifyError",
|
|
have: struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}{
|
|
specVector: testRegistrationSpecVectorNoneES256,
|
|
challenge: "wrong-challenge",
|
|
},
|
|
expected: struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}{
|
|
err: "Error validating challenge",
|
|
},
|
|
},
|
|
{
|
|
name: "ShouldSucceedMediationConditional",
|
|
have: struct {
|
|
specVector func(t *testing.T) (body []byte, challenge string, credentialID []byte)
|
|
challenge string
|
|
mediation protocol.CredentialMediationRequirement
|
|
setup func(t *testing.T, provider *mocks.MockMetadataProvider)
|
|
}{
|
|
specVector: testRegistrationSpecVectorNoneES256,
|
|
mediation: protocol.MediationConditional,
|
|
},
|
|
expected: struct {
|
|
attestationType string
|
|
attestationFormat string
|
|
err string
|
|
}{
|
|
attestationType: "none",
|
|
attestationFormat: "none",
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
body, challenge, credentialID := tc.have.specVector(t)
|
|
|
|
parsedResponse, err := protocol.ParseCredentialCreationResponseBytes(body)
|
|
require.NoError(t, err)
|
|
|
|
if tc.have.challenge != "" {
|
|
challenge = tc.have.challenge
|
|
}
|
|
|
|
userID := []byte("test-user-id")
|
|
|
|
config := &Config{
|
|
RPID: "example.org",
|
|
RPOrigins: []string{"https://example.org"},
|
|
}
|
|
|
|
if tc.have.setup != nil {
|
|
ctrl := gomock.NewController(t)
|
|
|
|
provider := mocks.NewMockMetadataProvider(ctrl)
|
|
|
|
tc.have.setup(t, provider)
|
|
|
|
config.MDS = provider
|
|
}
|
|
|
|
w := &WebAuthn{Config: config}
|
|
|
|
session := SessionData{
|
|
Challenge: challenge,
|
|
UserID: userID,
|
|
CredParams: credParams,
|
|
Mediation: tc.have.mediation,
|
|
}
|
|
|
|
user := &defaultUser{id: userID}
|
|
|
|
credential, err := w.CreateCredential(user, session, parsedResponse)
|
|
|
|
if tc.expected.err != "" {
|
|
assert.Nil(t, credential)
|
|
assert.EqualError(t, err, tc.expected.err)
|
|
} else {
|
|
assert.NoError(t, err)
|
|
require.NotNil(t, credential)
|
|
assert.Equal(t, credentialID, credential.ID)
|
|
assert.Equal(t, tc.expected.attestationType, credential.AttestationType)
|
|
assert.Equal(t, tc.expected.attestationFormat, credential.AttestationFormat)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestFinishRegistration_Success(t *testing.T) {
|
|
body, challenge, credentialID := testRegistrationSpecVectorNoneES256(t)
|
|
credParams := []protocol.CredentialParameter{{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgES256}}
|
|
|
|
userID := []byte("test-user-id")
|
|
|
|
w := &WebAuthn{
|
|
Config: &Config{
|
|
RPID: "example.org",
|
|
RPOrigins: []string{"https://example.org"},
|
|
},
|
|
}
|
|
|
|
session := SessionData{
|
|
Challenge: challenge,
|
|
UserID: userID,
|
|
CredParams: credParams,
|
|
}
|
|
|
|
user := &defaultUser{id: userID}
|
|
|
|
reqBody := io.NopCloser(bytes.NewReader(body))
|
|
httpReq := &http.Request{Body: reqBody}
|
|
|
|
credential, err := w.FinishRegistration(user, session, httpReq)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, credential)
|
|
assert.Equal(t, credentialID, credential.ID)
|
|
assert.Equal(t, "none", credential.AttestationType)
|
|
assert.Equal(t, "none", credential.AttestationFormat)
|
|
}
|
|
|
|
func TestValidateFilteredCredential(t *testing.T) {
|
|
aaguidA := uuid.MustParse("00000000-0000-0000-0000-00000000000a")
|
|
aaguidB := uuid.MustParse("00000000-0000-0000-0000-00000000000b")
|
|
aaguidC := uuid.MustParse("00000000-0000-0000-0000-00000000000c")
|
|
|
|
credentialWith := func(aaguid uuid.UUID, backupEligible bool) *Credential {
|
|
b, _ := aaguid.MarshalBinary()
|
|
|
|
flags := protocol.FlagUserPresent
|
|
if backupEligible {
|
|
flags |= protocol.FlagBackupEligible
|
|
}
|
|
|
|
return &Credential{
|
|
Flags: NewCredentialFlags(flags),
|
|
Authenticator: Authenticator{AAGUID: b},
|
|
}
|
|
}
|
|
|
|
testCases := []struct {
|
|
name string
|
|
filtering *FilteringConfig
|
|
credential *Credential
|
|
err string
|
|
}{
|
|
{
|
|
name: "ShouldAllowWhenFilteringNil",
|
|
filtering: nil,
|
|
credential: credentialWith(aaguidA, true),
|
|
},
|
|
{
|
|
name: "ShouldAllowNilCredentialWhenFilteringNil",
|
|
filtering: nil,
|
|
credential: nil,
|
|
},
|
|
{
|
|
name: "ShouldRejectNilCredentialWhenFilteringSet",
|
|
filtering: &FilteringConfig{},
|
|
credential: nil,
|
|
err: "Error reading the request data",
|
|
},
|
|
{
|
|
name: "ShouldRejectNilCredentialWhenFilteringHasPermittedList",
|
|
filtering: &FilteringConfig{PermittedAAGUIDs: []uuid.UUID{aaguidA}},
|
|
credential: nil,
|
|
err: "Error reading the request data",
|
|
},
|
|
{
|
|
name: "ShouldAllowWhenFilteringAllZeroValues",
|
|
filtering: &FilteringConfig{},
|
|
credential: credentialWith(aaguidA, true),
|
|
},
|
|
{
|
|
name: "ShouldRejectBackupEligibleWhenProhibited",
|
|
filtering: &FilteringConfig{ProhibitBackupEligibility: true},
|
|
credential: credentialWith(aaguidA, true),
|
|
err: "Policy restriction prevented the operation from completing",
|
|
},
|
|
{
|
|
name: "ShouldAllowNonBackupEligibleWhenProhibited",
|
|
filtering: &FilteringConfig{ProhibitBackupEligibility: true},
|
|
credential: credentialWith(aaguidA, false),
|
|
},
|
|
{
|
|
name: "ShouldAllowBackupEligibleWhenNotProhibited",
|
|
filtering: &FilteringConfig{ProhibitBackupEligibility: false},
|
|
credential: credentialWith(aaguidA, true),
|
|
},
|
|
{
|
|
name: "ShouldRejectMalformedAAGUID",
|
|
filtering: &FilteringConfig{},
|
|
credential: &Credential{
|
|
Authenticator: Authenticator{AAGUID: []byte{0x01, 0x02, 0x03}},
|
|
},
|
|
err: "Error reading the request data",
|
|
},
|
|
{
|
|
name: "ShouldAllowPermittedAAGUID",
|
|
filtering: &FilteringConfig{PermittedAAGUIDs: []uuid.UUID{aaguidA, aaguidB}},
|
|
credential: credentialWith(aaguidA, false),
|
|
},
|
|
{
|
|
name: "ShouldRejectAAGUIDNotInPermitList",
|
|
filtering: &FilteringConfig{PermittedAAGUIDs: []uuid.UUID{aaguidA, aaguidB}},
|
|
credential: credentialWith(aaguidC, false),
|
|
err: "Policy restriction prevented the operation from completing",
|
|
},
|
|
{
|
|
name: "ShouldAllowZeroAAGUIDEvenWhenNotInPermitList",
|
|
filtering: &FilteringConfig{PermittedAAGUIDs: []uuid.UUID{aaguidA}},
|
|
credential: credentialWith(uuid.Nil, false),
|
|
},
|
|
{
|
|
name: "ShouldAllowZeroAAGUIDWhenExplicitlyInPermitList",
|
|
filtering: &FilteringConfig{PermittedAAGUIDs: []uuid.UUID{uuid.Nil, aaguidA}},
|
|
credential: credentialWith(uuid.Nil, false),
|
|
},
|
|
{
|
|
name: "ShouldRejectProhibitedAAGUID",
|
|
filtering: &FilteringConfig{ProhibitedAAGUIDs: []uuid.UUID{aaguidB, aaguidC}},
|
|
credential: credentialWith(aaguidB, false),
|
|
err: "Policy restriction prevented the operation from completing",
|
|
},
|
|
{
|
|
name: "ShouldAllowAAGUIDNotInProhibitList",
|
|
filtering: &FilteringConfig{ProhibitedAAGUIDs: []uuid.UUID{aaguidB, aaguidC}},
|
|
credential: credentialWith(aaguidA, false),
|
|
},
|
|
{
|
|
name: "ShouldApplyBothPermittedAndProhibitedListsWhenSet",
|
|
filtering: &FilteringConfig{
|
|
PermittedAAGUIDs: []uuid.UUID{aaguidA, aaguidB},
|
|
ProhibitedAAGUIDs: []uuid.UUID{aaguidB},
|
|
},
|
|
credential: credentialWith(aaguidB, false),
|
|
err: "Policy restriction prevented the operation from completing",
|
|
},
|
|
{
|
|
name: "ShouldAllowWhenPermittedAndNotProhibited",
|
|
filtering: &FilteringConfig{
|
|
PermittedAAGUIDs: []uuid.UUID{aaguidA, aaguidB},
|
|
ProhibitedAAGUIDs: []uuid.UUID{aaguidC},
|
|
},
|
|
credential: credentialWith(aaguidA, false),
|
|
},
|
|
{
|
|
name: "ShouldCheckBackupEligibilityBeforeAAGUID",
|
|
filtering: &FilteringConfig{
|
|
ProhibitBackupEligibility: true,
|
|
PermittedAAGUIDs: []uuid.UUID{aaguidA},
|
|
},
|
|
credential: credentialWith(aaguidC, true),
|
|
err: "Policy restriction prevented the operation from completing",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
err := ValidateFilteredCredential(tc.credential, tc.filtering)
|
|
|
|
if tc.err == "" {
|
|
assert.NoError(t, err)
|
|
} else {
|
|
assert.EqualError(t, err, tc.err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// testRegistrationSpecVectorNoneES256 returns the spec test vector data for NoneES256 registration.
|
|
// See: https://www.w3.org/TR/webauthn-3/#sctn-test-vectors-none-es256
|
|
func testRegistrationSpecVectorNoneES256(t *testing.T) (body []byte, challenge string, credentialID []byte) {
|
|
t.Helper()
|
|
|
|
const (
|
|
attestationObjectHex = "a363666d74646e6f6e656761747453746d74a068617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b559000000008446ccb9ab1db374750b2367ff6f3a1f0020f91f391db4c9b2fde0ea70189cba3fb63f579ba6122b33ad94ff3ec330084be4a5010203262001215820afefa16f97ca9b2d23eb86ccb64098d20db90856062eb249c33a9b672f26df61225820930a56b87a2fca66334b03458abf879717c12cc68ed73290af2e2664796b9220"
|
|
clientDataJSONHex = "7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a22414d4d507434557878475453746e63647134313759447742466938767049612d7077386f4f755657345441222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a20426b5165446a646354427258426941774a544c453551227d"
|
|
credentialIDHex = "f91f391db4c9b2fde0ea70189cba3fb63f579ba6122b33ad94ff3ec330084be4" //nolint:gosec
|
|
challengeHex = "00c30fb78531c464d2b6771dab8d7b603c01162f2fa486bea70f283ae556e130"
|
|
)
|
|
|
|
credentialID, err := hex.DecodeString(credentialIDHex)
|
|
require.NoError(t, err)
|
|
|
|
challenge = base64.RawURLEncoding.EncodeToString(testRegDecodeHex(t, challengeHex))
|
|
|
|
id := base64.RawURLEncoding.EncodeToString(credentialID)
|
|
attObj := base64.RawURLEncoding.EncodeToString(testRegDecodeHex(t, attestationObjectHex))
|
|
cdj := base64.RawURLEncoding.EncodeToString(testRegDecodeHex(t, clientDataJSONHex))
|
|
|
|
response := map[string]any{
|
|
"id": id,
|
|
"rawId": id,
|
|
"type": "public-key",
|
|
"response": map[string]any{
|
|
"attestationObject": attObj,
|
|
"clientDataJSON": cdj,
|
|
},
|
|
}
|
|
|
|
body, err = json.Marshal(response)
|
|
require.NoError(t, err)
|
|
|
|
return body, challenge, credentialID
|
|
}
|
|
|
|
// testRegistrationSpecVectorPackedSelfES256 returns the spec test vector data for Packed Self ES256 registration.
|
|
// See: https://www.w3.org/TR/webauthn-3/#sctn-test-vectors-packed-self-es256
|
|
func testRegistrationSpecVectorPackedSelfES256(t *testing.T) (body []byte, challenge string, credentialID []byte) {
|
|
t.Helper()
|
|
|
|
const (
|
|
attestationObjectHex = "a363666d74667061636b65646761747453746d74a263616c672663736967584630440220067a20754ab925005dbf378097c92120031581c73228d1fb4f5b881bcd7da98302207fc7b147558c7c0eba3af18bd9d121fa3d3a26d17fe3f220272178f473b6006d68617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b55d00000000df850e09db6afbdfab51697791506cfc0020455ef34e2043a87db3d4afeb39bbcb6cc32df9347c789a865ecdca129cbef58ca5010203262001215820eb151c8176b225cc651559fecf07af450fd85802046656b34c18f6cf193843c5225820927b8aa427a2be1b8834d233a2d34f61f13bfd44119c325d5896e183fee484f2"
|
|
clientDataJSONHex = "7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a2265476e4374334c55745936366b336a506a796e6962506b31716e666644616966715a774c33417032392d55222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a205539685458764b453255526b4d6e625f307859485667227d"
|
|
credentialIDHex = "455ef34e2043a87db3d4afeb39bbcb6cc32df9347c789a865ecdca129cbef58c" //nolint:gosec
|
|
challengeHex = "7869c2b772d4b58eba9378cf8f29e26cf935aa77df0da89fa99c0bdc0a76f7e5"
|
|
)
|
|
|
|
credentialID, err := hex.DecodeString(credentialIDHex)
|
|
require.NoError(t, err)
|
|
|
|
challenge = base64.RawURLEncoding.EncodeToString(testRegDecodeHex(t, challengeHex))
|
|
|
|
id := base64.RawURLEncoding.EncodeToString(credentialID)
|
|
attObj := base64.RawURLEncoding.EncodeToString(testRegDecodeHex(t, attestationObjectHex))
|
|
cdj := base64.RawURLEncoding.EncodeToString(testRegDecodeHex(t, clientDataJSONHex))
|
|
|
|
response := map[string]any{
|
|
"id": id,
|
|
"rawId": id,
|
|
"type": "public-key",
|
|
"response": map[string]any{
|
|
"attestationObject": attObj,
|
|
"clientDataJSON": cdj,
|
|
},
|
|
}
|
|
|
|
body, err = json.Marshal(response)
|
|
require.NoError(t, err)
|
|
|
|
return body, challenge, credentialID
|
|
}
|
|
|
|
func testRegDecodeHex(t *testing.T, s string) []byte {
|
|
t.Helper()
|
|
|
|
data, err := hex.DecodeString(s)
|
|
require.NoError(t, err)
|
|
|
|
return data
|
|
}
|