robur/webauthn
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Attestation type, rework session variables

Browse source 
* Allow the user to select attestation type
* Rework session variables and challenge tracking
This commit is contained in:
Robur 2021-10-04 15:19:34 +00:00
parent a5af696428
commit ddebe8b804
2 changed files with 71 additions and 73 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
bin/template.ml
View file

@ -42,7 +42,7 @@ let overview notes authenticated_as users =
let register_view origin user =
let script = Printf.sprintf {|
function makePublicKey(challengeData) {
function makePublicKey(challengeData, attestation) {
let challenge = Uint8Array.from(window.atob(challengeData.challenge), c=>c.charCodeAt(0));
let user_id = Uint8Array.from(window.atob(challengeData.user.id), c=>c.charCodeAt(0));
return {
@ -62,16 +62,16 @@ let register_view origin user =
alg: -7
}
],
attestation: "direct",
attestation: attestation,
excludeCredentials: challengeData.excludeCredentials.map(id => ({ type: "public-key",
id: Uint8Array.from(window.atob(id), c=>c.charCodeAt(0))}))
};
}
function do_register(username) {
function do_register(username, attestation) {
fetch("/registration-challenge/"+username)
.then(response => response.json())
.then(function (challengeData) {
let publicKey = makePublicKey(challengeData);
let publicKey = makePublicKey(challengeData, attestation);
navigator.credentials.create({ publicKey })
.then(function (credential) {
let response = credential.response;
@ -92,7 +92,7 @@ let register_view origin user =
let headers = {'Content-type': "application/json; charset=utf-8"};
let request = new Request('/register_finish', { method: 'POST', body: body, headers: headers } );
let request = new Request('/register_finish/'+username, { method: 'POST', body: body, headers: headers } );
fetch(request)
.then(function (response) {
if (!response.ok && response.status != 403) {
@ -111,7 +111,8 @@ let register_view origin user =
}
function doit() {
let username = document.getElementById("username").value;
return do_register(username);
let attestation = document.getElementById("attestation").value;
return do_register(username, attestation);
}
|} origin
and body =
@ -119,6 +120,11 @@ let register_view origin user =
<p>Welcome.</p>
<form method="post" id="form" onsubmit="return false;">
<label for="username" >Desired username</label><input name="username" id="username" value="%s"/>
<label for="attestation">Attestation type</label><select name="attestation" id="attestation">
<option value="direct">direct</option>
<option value="indirect">indirect</option>
<option value="none">none</option>
</select>
<button id="button" type="button" onclick="doit()">Register</button>
</form>
|} user
@ -155,8 +161,8 @@ let authenticate_view challenge credentials user =
});
let headers = {'Content-type': "application/json; charset=utf-8"};
let request = new Request('/authenticate_finish', { method: 'POST', body: body, headers: headers } );
let username = window.location.pathname.substring("/authenticate/".length);
let request = new Request('/authenticate_finish/'+username, { method: 'POST', body: body, headers: headers } );
fetch(request)
.then(function (response) {
if (!response.ok) {

122
bin/webauthn_demo.ml
View file

@ -22,7 +22,9 @@ let check_counter kh_pub counter =
then KhPubHashtbl.replace counters kh_pub counter;
r
let challenges : (string, string) Hashtbl.t = Hashtbl.create 7
let registration_challenges : (string, string) Hashtbl.t = Hashtbl.create 7
let authentication_challenges : (string, string) Hashtbl.t = Hashtbl.create 7
let to_string err = Format.asprintf "%a" Webauthn.pp_error err
@ -51,7 +53,7 @@ let add_routes t =
let challenge = Cstruct.to_string (Mirage_crypto_rng.generate 16)
(* [userid] should be a random value *)
and userid = Base64.encode_string ~pad:false ~alphabet:Base64.uri_safe_alphabet user in
Hashtbl.replace challenges challenge user;
Hashtbl.replace registration_challenges user challenge;
let credentials = match Hashtbl.find_opt users user with
| None -> []
| Some credentials -> List.map (fun (_, cid, _) -> cid) credentials
@ -68,18 +70,19 @@ let add_routes t =
]
in
Logs.info (fun m -> m "produced challenge for user %s: %s" user challenge_b64);
Dream.put_session "challenge" challenge req >>= fun () ->
Dream.json (Yojson.Safe.to_string json)
in
let register_finish req =
let user = Dream.param "user" req in
Dream.body req >>= fun body ->
Logs.info (fun m -> m "received body: %s" body);
match Dream.session "challenge" req with
match Hashtbl.find_opt registration_challenges user with
| None ->
Logs.warn (fun m -> m "no challenge found");
Dream.respond ~status:`Bad_Request "Bad request."
| Some challenge ->
Hashtbl.remove registration_challenges user;
match Webauthn.register_response t challenge body with
| Error e ->
Logs.warn (fun m -> m "error %a" Webauthn.pp_error e);
@ -90,39 +93,32 @@ let add_routes t =
user_verified, sig_count, _authenticator_extensions, attestation_cert) ->
ignore (check_counter (credential_id, pubkey) sig_count);
Logs.info (fun m -> m "user present %B user verified %B" user_present user_verified);
match Hashtbl.find_opt challenges challenge with
| None ->
Logs.warn (fun m -> m "challenge not registered");
Dream.respond ~status:`Internal_Server_Error
"Internal server error: couldn't find user for challenge"
| Some user ->
Logs.app (fun m -> m "challenge for user %S" user);
Hashtbl.remove challenges challenge;
match Dream.session "authenticated_as" req, Hashtbl.find_opt users user with
| _, None ->
Logs.app (fun m -> m "challenge for user %S" user);
match Dream.session "authenticated_as" req, Hashtbl.find_opt users user with
| _, None ->
Logs.app (fun m -> m "registered %s: %S" user credential_id);
Hashtbl.replace users user [ (pubkey, credential_id, attestation_cert) ];
Dream.invalidate_session req >>= fun () ->
Flash_message.put_flash ""
(Printf.sprintf "Successfully registered as %s! <a href=\"/authenticate/%s\">[authenticate]</a>" user user)
req;
Dream.json "true"
| Some session_user, Some keys ->
Logs.app (fun m -> m "user %S session_user %S" user session_user);
if String.equal user session_user then begin
Logs.app (fun m -> m "registered %s: %S" user credential_id);
Hashtbl.replace users user [ (pubkey, credential_id, attestation_cert) ];
Hashtbl.replace users user ((pubkey, credential_id, attestation_cert) :: keys) ;
Dream.invalidate_session req >>= fun () ->
Flash_message.put_flash ""
(Printf.sprintf "Successfully registered as %s! <a href=\"/authenticate/%s\">[authenticate]</a>" user user)
req;
Dream.json "true"
| Some session_user, Some keys ->
Logs.app (fun m -> m "user %S session_user %S" user session_user);
if String.equal user session_user then begin
Logs.app (fun m -> m "registered %s: %S" user credential_id);
Hashtbl.replace users user ((pubkey, credential_id, attestation_cert) :: keys) ;
Dream.invalidate_session req >>= fun () ->
Flash_message.put_flash ""
(Printf.sprintf "Successfully registered as %s! <a href=\"/authenticate/%s\">[authenticate]</a>" user user)
req;
Dream.json "true"
end else
(Logs.info (fun m -> m "session_user %s, user %s" session_user user);
Dream.json ~status:`Forbidden "false")
| None, Some _keys ->
Logs.app (fun m -> m "no session user");
Dream.json ~status:`Forbidden "false"
end else
(Logs.info (fun m -> m "session_user %s, user %s" session_user user);
Dream.json ~status:`Forbidden "false")
| None, Some _keys ->
Logs.app (fun m -> m "no session user");
Dream.json ~status:`Forbidden "false"
in
let authenticate req =
@ -134,48 +130,44 @@ let add_routes t =
| Some keys ->
let credentials = List.map (fun (_, c, _) -> Base64.encode_string c) keys in
let challenge = Cstruct.to_string (Mirage_crypto_rng.generate 16) in
Dream.put_session "challenge" challenge req >>= fun () ->
Dream.put_session "challenge_user" user req >>= fun () ->
Hashtbl.replace authentication_challenges user challenge;
Dream.html (Template.authenticate_view (Base64.encode_string challenge) credentials user)
in
let authenticate_finish req =
let user = Dream.param "user" req in
Dream.body req >>= fun body ->
Logs.info (fun m -> m "received body: %s" body);
match Dream.session "challenge_user" req with
match Hashtbl.find_opt authentication_challenges user with
| None -> Dream.respond ~status:`Internal_Server_Error "Internal server error."
| Some user ->
match Dream.session "challenge" req with
| Some challenge ->
Hashtbl.remove authentication_challenges user;
match Hashtbl.find_opt users user with
| None ->
Logs.warn (fun m -> m "no challenge found");
Logs.warn (fun m -> m "no user found, using empty");
Dream.respond ~status:`Bad_Request "Bad request."
| Some challenge ->
match Hashtbl.find_opt users user with
| None ->
Logs.warn (fun m -> m "no user found, using empty");
Dream.respond ~status:`Bad_Request "Bad request."
| Some keys ->
let cid_keys = List.map (fun (key, credential_id, _) -> credential_id, key) keys in
match Webauthn.authentication_response t cid_keys challenge body with
| Ok (credential, _client_extensions, _user_present, _user_verified, counter, _authenticator_extensions) ->
if check_counter credential counter
then begin
Flash_message.put_flash "" "Successfully authenticated" req;
Dream.put_session "user" user req >>= fun () ->
Dream.put_session "authenticated_as" user req >>= fun () ->
Dream.json "true"
end else begin
Logs.warn (fun m -> m "credential %S for user %S: counter not strictly increasing! \
Got %ld, expected >%ld. webauthn device compromised?"
(fst credential) user counter (KhPubHashtbl.find counters credential));
Flash_message.put_flash "" "Authentication failure: key compromised?" req;
Dream.json "false"
end
| Error e ->
Logs.warn (fun m -> m "error %a" Webauthn.pp_error e);
let err = to_string e in
Flash_message.put_flash "" ("Authentication failure: " ^ err) req;
| Some keys ->
let cid_keys = List.map (fun (key, credential_id, _) -> credential_id, key) keys in
match Webauthn.authentication_response t cid_keys challenge body with
| Ok (credential, _client_extensions, _user_present, _user_verified, counter, _authenticator_extensions) ->
if check_counter credential counter
then begin
Flash_message.put_flash "" "Successfully authenticated" req;
Dream.put_session "user" user req >>= fun () ->
Dream.put_session "authenticated_as" user req >>= fun () ->
Dream.json "true"
end else begin
Logs.warn (fun m -> m "credential %S for user %S: counter not strictly increasing! \
Got %ld, expected >%ld. webauthn device compromised?"
(fst credential) user counter (KhPubHashtbl.find counters credential));
Flash_message.put_flash "" "Authentication failure: key compromised?" req;
Dream.json "false"
end
| Error e ->
Logs.warn (fun m -> m "error %a" Webauthn.pp_error e);
let err = to_string e in
Flash_message.put_flash "" ("Authentication failure: " ^ err) req;
Dream.json "false"
in
let logout req =
@ -192,9 +184,9 @@ let add_routes t =
Dream.get "/" main;
Dream.get "/register" register;
Dream.get "/registration-challenge/:user" registration_challenge;
Dream.post "/register_finish" register_finish;
Dream.post "/register_finish/:user" register_finish;
Dream.get "/authenticate/:user" authenticate;
Dream.post "/authenticate_finish" authenticate_finish;
Dream.post "/authenticate_finish/:user" authenticate_finish;
Dream.post "/logout" logout;
Dream.get "/static/base64.js" base64;
]