root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 9 Packages Projects Releases Wiki Activity

webauthn: ensure allowCredentials[].id is an ArrayBuffer 

closes gh-16439

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
This commit is contained in:
Daniel Garnier-Moiroux 2025-01-17 15:07:24 +01:00
parent 60dbeba985
commit 5bf42bb7a8
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/lib/webauthn-core.js
View File

@ -41,8 +41,16 @@ async function authenticate(headers, contextPath, useConditionalMediation) {
}
// FIXME: Use https://www.w3.org/TR/webauthn-3/#sctn-parseRequestOptionsFromJSON
const decodedAllowCredentials = !options.allowCredentials
? []
: options.allowCredentials.map((cred) => ({
...cred,
id: base64url.decode(cred.id),
}));
const decodedOptions = {
...options,
allowCredentials: decodedAllowCredentials,
challenge: base64url.decode(options.challenge),
};

16
javascript/test/webauthn-core.test.js
View File

@ -85,7 +85,13 @@ describe("webauthn-core", () => {
challenge: "nRbOrtNKTfJ1JaxfUDKs8j3B-JFqyGQw8DO4u6eV3JA",
timeout: 300000,
rpId: "localhost",
allowCredentials: [],
allowCredentials: [
{
id: "nOsjw8eaaqSwVdTBBYE1FqfGdHs",
type: "public-key",
transports: [],
},
],
userVerification: "preferred",
extensions: {},
};
@ -172,7 +178,13 @@ describe("webauthn-core", () => {
challenge: base64url.decode("nRbOrtNKTfJ1JaxfUDKs8j3B-JFqyGQw8DO4u6eV3JA"),
timeout: 300000,
rpId: "localhost",
allowCredentials: [],
allowCredentials: [
{
id: base64url.decode("nOsjw8eaaqSwVdTBBYE1FqfGdHs"),
type: "public-key",
transports: [],
},
],
userVerification: "preferred",
extensions: {},
},