nodemailer/wildduck
1
1
Fork 0
mirror of https://github.com/nodemailer/wildduck.git synced 2024-12-29 11:46:30 +08:00
Code Issues Projects Releases Packages Wiki Activity

Added rpId to webauthnAssertAuthentication expectations

Browse source 
This allows for authentication from subdomains. Fido2Lib.assertionResult compares the rpIdHash returned by the users browser, and since the key is created on the main domain it can't use the passed in origin for the hash comparison. 

The related Fido2Lib line: a5003fa5bf/lib/validator.js (L437)
This commit is contained in:
jissepo 2022-05-24 11:43:19 +03:00 committed by GitHub
parent 46961586c5
commit fda7f199ad
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/user-handler.js
View file

@ -2713,7 +2713,8 @@ class UserHandler {
factor: 'either', factor: 'either',
publicKey: credentialData.publicKey, publicKey: credentialData.publicKey,
prevCounter: credentialData.counter, prevCounter: credentialData.counter,
userHandle: null userHandle: null,
rpId: config.webauthn.rpId
}; };
const f2l = new Fido2Lib(Object.assign({}, config.webauthn)); const f2l = new Fido2Lib(Object.assign({}, config.webauthn));