Diff
Modified: trunk/LayoutTests/ChangeLog (243192 => 243193)
--- trunk/LayoutTests/ChangeLog 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/ChangeLog 2019-03-20 06:11:57 UTC (rev 243193)
@@ -1,3 +1,23 @@
+2019-03-19 Jiewen Tan <[email protected]>
+
+ [WebAuthN] Implement FIDO AppID extension
+ https://bugs.webkit.org/show_bug.cgi?id=143491
+ <rdar://problem/48298273>
+
+ Reviewed by Brent Fulgham.
+
+ * http/wpt/webauthn/public-key-credential-create-success-hid.https.html:
+ * http/wpt/webauthn/public-key-credential-create-success-local.https.html:
+ * http/wpt/webauthn/public-key-credential-create-success-u2f.https.html:
+ * http/wpt/webauthn/public-key-credential-get-failure-u2f.https-expected.txt:
+ * http/wpt/webauthn/public-key-credential-get-failure-u2f.https.html:
+ * http/wpt/webauthn/public-key-credential-get-failure.https-expected.txt:
+ * http/wpt/webauthn/public-key-credential-get-failure.https.html:
+ * http/wpt/webauthn/public-key-credential-get-success-hid.https.html:
+ * http/wpt/webauthn/public-key-credential-get-success-local.https.html:
+ * http/wpt/webauthn/public-key-credential-get-success-u2f.https-expected.txt:
+ * http/wpt/webauthn/public-key-credential-get-success-u2f.https.html:
+
2019-03-19 Ryosuke Niwa <[email protected]>
Rebaseline the test after r243175. It got somehow landed with failing expectations.
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -16,7 +16,7 @@
assert_equals(credential.type, 'public-key');
assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testHidCredentialIdBase64));
assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.create","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
- assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+ assert_not_exists(credential.getClientExtensionResults(), "appid");
// Check attestation
const attestationObject = CBOR.decode(credential.response.attestationObject);
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -30,7 +30,7 @@
assert_equals(credential.type, 'public-key');
assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testCredentialIdBase64));
assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.create","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
- assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+ assert_not_exists(credential.getClientExtensionResults(), "appid");
// Check attestation
const attestationObject = CBOR.decode(credential.response.attestationObject);
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-u2f.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-u2f.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-u2f.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -12,7 +12,7 @@
assert_equals(credential.type, 'public-key');
assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testU2fCredentialIdBase64));
assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.create","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
- assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+ assert_not_exists(credential.getClientExtensionResults(), "appid");
// Check attestation
const attestationObject = CBOR.decode(credential.response.attestationObject);
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https-expected.txt (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https-expected.txt 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https-expected.txt 2019-03-20 06:11:57 UTC (rev 243193)
@@ -2,4 +2,6 @@
PASS PublicKeyCredential's [[get]] with malformed sign response in a mock hid authenticator.
PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator.
PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2
+PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. (AppID)
+PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2 (AppID)
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -42,4 +42,33 @@
testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "malicious-payload", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64] } });
return promiseRejects(t, "NotAllowedError", navigator.credentials.get(options), "No credentials from the allowCredentials list is found in the authenticator.");
}, "PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2");
+
+ // With AppID extension
+ promise_test(function(t) {
+ const options = {
+ publicKey: {
+ challenge: asciiToUint8Array("123456"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }],
+ extensions: { appid: "" }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "malicious-payload", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64] } });
+ return promiseRejects(t, "NotAllowedError", navigator.credentials.get(options), "No credentials from the allowCredentials list is found in the authenticator.");
+ }, "PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. (AppID)");
+
+ promise_test(function(t) {
+ const options = {
+ publicKey: {
+ challenge: asciiToUint8Array("123456"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }, { type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }],
+ extensions: { appid: "" }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "malicious-payload", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64] } });
+ return promiseRejects(t, "NotAllowedError", navigator.credentials.get(options), "No credentials from the allowCredentials list is found in the authenticator.");
+ }, "PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2 (AppID)");
</script>
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https-expected.txt (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https-expected.txt 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https-expected.txt 2019-03-20 06:11:57 UTC (rev 243193)
@@ -1,4 +1,8 @@
PASS PublicKeyCredential's [[get]] with timeout
PASS PublicKeyCredential's [[get]] with a mismatched RP ID
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (invalid URLs)
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (different protocols)
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 1)
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 2)
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -31,4 +31,52 @@
return promiseRejects(t, "SecurityError",
navigator.credentials.get(options), "The origin of the document is not a registrable domain suffix of the provided RP ID.");
}, "PublicKeyCredential's [[get]] with a mismatched RP ID");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: asciiToUint8Array("123456"),
+ extensions: { appid: "abc" }
+ }
+ };
+
+ return promiseRejects(t, "SecurityError",
+ navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+ }, "PublicKeyCredential's [[get]] with a mismatched APP ID (invalid URLs)");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: asciiToUint8Array("123456"),
+ extensions: { appid: "ftp://localhost" }
+ }
+ };
+
+ return promiseRejects(t, "SecurityError",
+ navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+ }, "PublicKeyCredential's [[get]] with a mismatched APP ID (different protocols)");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: asciiToUint8Array("123456"),
+ extensions: { appid: "https://127.0.0.1" }
+ }
+ };
+
+ return promiseRejects(t, "SecurityError",
+ navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+ }, "PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 1)");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: asciiToUint8Array("123456"),
+ extensions: { appid: "https://haha.localhost" }
+ }
+ };
+
+ return promiseRejects(t, "SecurityError",
+ navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+ }, "PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 2)");
</script>
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -16,6 +16,7 @@
assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testHidCredentialIdBase64));
assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.get","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
assert_equals(credential.response.userHandle, null);
+ assert_not_exists(credential.getClientExtensionResults(), "appid");
// Check authData
const authData = decodeAuthData(new Uint8Array(credential.response.authenticatorData));
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-local.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-local.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-local.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -19,6 +19,7 @@
assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testCredentialIdBase64));
assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.get","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
assert_equals(bytesToHexString(credential.response.userHandle), "00010203040506070809");
+ assert_not_exists(credential.getClientExtensionResults(), "appid");
// Check authData
const authData = decodeAuthData(new Uint8Array(credential.response.authenticatorData));
@@ -32,7 +33,7 @@
// credential.response.signature is in ASN.1 and WebCrypto expect signatures provides in r|s.
return crypto.subtle.verify({name: "ECDSA", hash: "SHA-256"}, publicKey, extractRawSignature(credential.response.signature), concatenateBuffers(credential.response.authenticatorData, hash)).then( verified => {
assert_true(verified);
- assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+ assert_not_exists(credential.getClientExtensionResults(), "appid");
});
});
});
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https-expected.txt (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https-expected.txt 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https-expected.txt 2019-03-20 06:11:57 UTC (rev 243193)
@@ -2,4 +2,10 @@
PASS PublicKeyCredential's [[get]] with minimum options in a mock hid authenticator.
PASS PublicKeyCredential's [[get]] with more allow credentials in a mock hid authenticator.
PASS PublicKeyCredential's [[get]] with test of user presence in a mock hid authenticator.
+PASS PublicKeyCredential's [[get]] with empty extensions in a mock hid authenticator.
+PASS PublicKeyCredential's [[get]] with same site AppID but not used in a mock hid authenticator.
+PASS PublicKeyCredential's [[get]] with empty AppID in a mock hid authenticator.
+PASS PublicKeyCredential's [[get]] with an AppID in a mock hid authenticator.
+PASS PublicKeyCredential's [[get]] with multiple credentials and AppID is not used in a mock hid authenticator.
+PASS PublicKeyCredential's [[get]] with multiple credentials and AppID is used in a mock hid authenticator.
Modified: trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https.html (243192 => 243193)
--- trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https.html 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https.html 2019-03-20 06:11:57 UTC (rev 243193)
@@ -4,7 +4,9 @@
<script src=""
<script src=""
<script>
- function checkResult(credential)
+ const defaultAppIDHash = "c2671b6eb9233197d5f2b1288a55ba4f0860f96f7199bba32fe6da7c3f0f31e5";
+
+ function checkResult(credential, isAppID = false, appIDHash = defaultAppIDHash)
{
// Check respond
assert_array_equals(Base64URL.parse(credential.id), Base64URL.parse(testU2fCredentialIdBase64));
@@ -12,10 +14,17 @@
assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testU2fCredentialIdBase64));
assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.get","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
assert_equals(credential.response.userHandle, null);
+ if (!isAppID)
+ assert_not_exists(credential.getClientExtensionResults(), "appid");
+ else
+ assert_true(credential.getClientExtensionResults().appid);
// Check authData
const authData = decodeAuthData(new Uint8Array(credential.response.authenticatorData));
- assert_equals(bytesToHexString(authData.rpIdHash), "49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763");
+ if (!isAppID)
+ assert_equals(bytesToHexString(authData.rpIdHash), "49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763");
+ else
+ assert_equals(bytesToHexString(authData.rpIdHash), appIDHash);
assert_equals(authData.flags, 1);
assert_equals(authData.counter, 59);
}
@@ -67,4 +76,109 @@
return checkResult(credential);
});
}, "PublicKeyCredential's [[get]] with test of user presence in a mock hid authenticator.");
+
+ // With AppID extension
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: Base64URL.parse("MTIzNDU2"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+ timeout: 100,
+ extensions: { }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fSignResponse] } });
+ return navigator.credentials.get(options).then(credential => {
+ return checkResult(credential);
+ });
+ }, "PublicKeyCredential's [[get]] with empty extensions in a mock hid authenticator.");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: Base64URL.parse("MTIzNDU2"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+ timeout: 100,
+ extensions: { appid: "https://localhost:666/appid" }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fSignResponse] } });
+ return navigator.credentials.get(options).then(credential => {
+ return checkResult(credential);
+ });
+ }, "PublicKeyCredential's [[get]] with same site AppID but not used in a mock hid authenticator.");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: Base64URL.parse("MTIzNDU2"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+ timeout: 100,
+ extensions: { appid: "" }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+ return navigator.credentials.get(options).then(credential => {
+ return checkResult(credential, true);
+ });
+ }, "PublicKeyCredential's [[get]] with empty AppID in a mock hid authenticator.");
+
+ // FIXME: Sub domains need to be tested as well. However, localhost has no sub domains.
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: Base64URL.parse("MTIzNDU2"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+ timeout: 100,
+ extensions: { appid: "https://localhost:666/appid" }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+ return navigator.credentials.get(options).then(credential => {
+ return checkResult(credential, true, "7eabc5cc3251bdc59115ef87b5f7ee74cb03747e39ba8341748565cc129c0719");
+ });
+ }, "PublicKeyCredential's [[get]] with an AppID in a mock hid authenticator.");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: Base64URL.parse("MTIzNDU2"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }, { type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+ timeout: 100,
+ extensions: { appid: "" }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+ return navigator.credentials.get(options).then(credential => {
+ return checkResult(credential);
+ });
+ }, "PublicKeyCredential's [[get]] with multiple credentials and AppID is not used in a mock hid authenticator.");
+
+ promise_test(t => {
+ const options = {
+ publicKey: {
+ challenge: Base64URL.parse("MTIzNDU2"),
+ allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }, { type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+ timeout: 100,
+ extensions: { appid: "" }
+ }
+ };
+
+ if (window.testRunner)
+ testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+ return navigator.credentials.get(options).then(credential => {
+ return checkResult(credential, true);
+ });
+ }, "PublicKeyCredential's [[get]] with multiple credentials and AppID is used in a mock hid authenticator.");
+
</script>
Modified: trunk/Source/WebCore/CMakeLists.txt (243192 => 243193)
--- trunk/Source/WebCore/CMakeLists.txt 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/CMakeLists.txt 2019-03-20 06:11:57 UTC (rev 243193)
@@ -438,6 +438,7 @@
Modules/webaudio/ScriptProcessorNode.idl
Modules/webaudio/WaveShaperNode.idl
+ Modules/webauthn/AuthenticationExtensionsClientInputs.idl
Modules/webauthn/AuthenticatorAssertionResponse.idl
Modules/webauthn/AuthenticatorAttestationResponse.idl
Modules/webauthn/AuthenticatorResponse.idl
Modified: trunk/Source/WebCore/ChangeLog (243192 => 243193)
--- trunk/Source/WebCore/ChangeLog 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/ChangeLog 2019-03-20 06:11:57 UTC (rev 243193)
@@ -1,3 +1,60 @@
+2019-03-19 Jiewen Tan <[email protected]>
+
+ [WebAuthN] Implement FIDO AppID extension
+ https://bugs.webkit.org/show_bug.cgi?id=143491
+ <rdar://problem/48298273>
+
+ Reviewed by Brent Fulgham.
+
+ This patch adds support for FIDO AppID extension: https://www.w3.org/TR/webauthn/#sctn-appid-extension.
+ To be noticed, this implementation follows what spec suggested in the 'Note' session and what Chrome/Firefox
+ do in practice to avoid some unnecessary steps of
+ https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid.
+
+ In fido::convertToU2fSignCommand, the checkOnly flag is deleted as it is never used.
+
+ Covered by new tests in existing files.
+
+ * CMakeLists.txt:
+ * DerivedSources-input.xcfilelist:
+ * DerivedSources-output.xcfilelist:
+ * DerivedSources.make:
+ * Modules/webauthn/AuthenticationExtensionsClientInputs.h: Copied from Source/WebCore/Modules/webauthn/PublicKeyCredential.idl.
+ (WebCore::AuthenticationExtensionsClientInputs::encode const):
+ (WebCore::AuthenticationExtensionsClientInputs::decode):
+ * Modules/webauthn/AuthenticationExtensionsClientInputs.idl: Copied from Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl.
+ * Modules/webauthn/AuthenticatorCoordinator.cpp:
+ (WebCore::AuthenticatorCoordinatorInternal::processAppIdExtension):
+ (WebCore::AuthenticatorCoordinator::create const):
+ (WebCore::AuthenticatorCoordinator::discoverFromExternalSource const):
+ * Modules/webauthn/PublicKeyCredential.cpp:
+ (WebCore::PublicKeyCredential::tryCreate):
+ (WebCore::PublicKeyCredential::PublicKeyCredential):
+ (WebCore::PublicKeyCredential::getClientExtensionResults const):
+ (WebCore::PublicKeyCredential::create): Deleted.
+ * Modules/webauthn/PublicKeyCredential.h:
+ * Modules/webauthn/PublicKeyCredential.idl:
+ * Modules/webauthn/PublicKeyCredentialCreationOptions.h:
+ * Modules/webauthn/PublicKeyCredentialCreationOptions.idl:
+ * Modules/webauthn/PublicKeyCredentialData.h:
+ (WebCore::PublicKeyCredentialData::encode const):
+ (WebCore::PublicKeyCredentialData::decode):
+ * Modules/webauthn/PublicKeyCredentialRequestOptions.h:
+ (WebCore::PublicKeyCredentialRequestOptions::encode const):
+ (WebCore::PublicKeyCredentialRequestOptions::decode):
+ * Modules/webauthn/PublicKeyCredentialRequestOptions.idl:
+ * Modules/webauthn/fido/DeviceResponseConverter.cpp:
+ (fido::readCTAPMakeCredentialResponse):
+ (fido::readCTAPGetAssertionResponse):
+ * Modules/webauthn/fido/U2fCommandConstructor.cpp:
+ (fido::convertToU2fSignCommand):
+ * Modules/webauthn/fido/U2fCommandConstructor.h:
+ * Modules/webauthn/fido/U2fResponseConverter.cpp:
+ (fido::readU2fRegisterResponse):
+ (fido::readU2fSignResponse):
+ * Sources.txt:
+ * WebCore.xcodeproj/project.pbxproj:
+
2019-03-19 Devin Rousso <[email protected]>
Web Inspector: Debugger: lazily create the agent
Modified: trunk/Source/WebCore/DerivedSources-input.xcfilelist (243192 => 243193)
--- trunk/Source/WebCore/DerivedSources-input.xcfilelist 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/DerivedSources-input.xcfilelist 2019-03-20 06:11:57 UTC (rev 243193)
@@ -304,6 +304,7 @@
$(PROJECT_DIR)/Modules/webaudio/PeriodicWave.idl
$(PROJECT_DIR)/Modules/webaudio/ScriptProcessorNode.idl
$(PROJECT_DIR)/Modules/webaudio/WaveShaperNode.idl
+$(PROJECT_DIR)/Modules/webauthn/AuthenticationExtensionsClientInputs.idl
$(PROJECT_DIR)/Modules/webauthn/AuthenticatorAssertionResponse.idl
$(PROJECT_DIR)/Modules/webauthn/AuthenticatorAttestationResponse.idl
$(PROJECT_DIR)/Modules/webauthn/AuthenticatorResponse.idl
Modified: trunk/Source/WebCore/DerivedSources-output.xcfilelist (243192 => 243193)
--- trunk/Source/WebCore/DerivedSources-output.xcfilelist 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/DerivedSources-output.xcfilelist 2019-03-20 06:11:57 UTC (rev 243193)
@@ -154,6 +154,8 @@
$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAudioTrackList.h
$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAudioTrackMediaSource.cpp
$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAudioTrackMediaSource.h
+$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticationExtensionsClientInputs.cpp
+$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticationExtensionsClientInputs.h
$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticatorAssertionResponse.cpp
$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticatorAssertionResponse.h
$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticatorAttestationResponse.cpp
Modified: trunk/Source/WebCore/DerivedSources.make (243192 => 243193)
--- trunk/Source/WebCore/DerivedSources.make 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/DerivedSources.make 2019-03-20 06:11:57 UTC (rev 243193)
@@ -351,6 +351,7 @@
$(WebCore)/Modules/webaudio/PeriodicWave.idl \
$(WebCore)/Modules/webaudio/ScriptProcessorNode.idl \
$(WebCore)/Modules/webaudio/WaveShaperNode.idl \
+ $(WebCore)/Modules/webauthn/AuthenticationExtensionsClientInputs.idl \
$(WebCore)/Modules/webauthn/AuthenticatorAssertionResponse.idl \
$(WebCore)/Modules/webauthn/AuthenticatorAttestationResponse.idl \
$(WebCore)/Modules/webauthn/AuthenticatorResponse.idl \
Copied: trunk/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.h (from rev 243192, trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.idl) (0 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.h (rev 0)
+++ trunk/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEB_AUTHN)
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+struct AuthenticationExtensionsClientInputs {
+ String appid;
+
+ template<class Encoder> void encode(Encoder&) const;
+ template<class Decoder> static Optional<AuthenticationExtensionsClientInputs> decode(Decoder&);
+};
+
+template<class Encoder>
+void AuthenticationExtensionsClientInputs::encode(Encoder& encoder) const
+{
+ encoder << appid;
+}
+
+template<class Decoder>
+Optional<AuthenticationExtensionsClientInputs> AuthenticationExtensionsClientInputs::decode(Decoder& decoder)
+{
+ AuthenticationExtensionsClientInputs result;
+
+ Optional<String> appid;
+ decoder >> appid;
+ if (!appid)
+ return WTF::nullopt;
+ result.appid = WTFMove(*appid);
+
+ return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUTHN)
Copied: trunk/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.idl (from rev 243192, trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl) (0 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.idl (rev 0)
+++ trunk/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.idl 2019-03-20 06:11:57 UTC (rev 243193)
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+[
+ Conditional=WEB_AUTHN,
+] dictionary AuthenticationExtensionsClientInputs {
+ USVString appid;
+};
Modified: trunk/Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -37,6 +37,8 @@
#include "PublicKeyCredentialCreationOptions.h"
#include "PublicKeyCredentialData.h"
#include "PublicKeyCredentialRequestOptions.h"
+#include "RegistrableDomain.h"
+#include "SchemeRegistry.h"
#include "SecurityOrigin.h"
#include <pal/crypto/CryptoDigest.h>
#include <wtf/JSONValues.h>
@@ -78,6 +80,27 @@
return crypto->computeHash();
}
+// The following roughly implements Step 1-3 of the spec to avoid the complexity of making unnecessary network requests:
+// https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid
+// It follows what Chrome and Firefox do, see:
+// https://bugzilla.mozilla.org/show_bug.cgi?id=1244959#c8
+// https://bugs.chromium.org/p/chromium/issues/detail?id=818303
+static String processAppIdExtension(const SecurityOrigin& facetId, const String& appId)
+{
+ // Step 1. Skipped since facetId should always be secure origins.
+ ASSERT(SchemeRegistry::shouldTreatURLSchemeAsSecure(facetId.protocol()));
+
+ // Step 2. Follow Chrome and Firefox to use the origin directly without adding a trailing slash.
+ if (appId.isEmpty())
+ return facetId.toString();
+
+ // Step 3. Relax the comparison to same site.
+ URL appIdURL(URL(), appId);
+ if (!appIdURL.isValid() || facetId.protocol() != appIdURL.protocol() || RegistrableDomain(appIdURL) != RegistrableDomain::uncheckedCreateFromHost(facetId.host()))
+ return String();
+ return appId;
+}
+
} // namespace AuthenticatorCoordinatorInternal
AuthenticatorCoordinator::AuthenticatorCoordinator(std::unique_ptr<AuthenticatorCoordinatorClient>&& client)
@@ -95,7 +118,7 @@
using namespace AuthenticatorCoordinatorInternal;
// The following implements https://www.w3.org/TR/webauthn/#createCredential as of 5 December 2017.
- // FIXME: Extensions are not supported yet. Skip Step 11-12.
+ // Extensions are not supported. Skip Step 11-12.
// Step 1, 3, 16 are handled by the caller.
// Step 2.
if (!sameOriginWithAncestors) {
@@ -158,7 +181,6 @@
using namespace AuthenticatorCoordinatorInternal;
// The following implements https://www.w3.org/TR/webauthn/#createCredential as of 5 December 2017.
- // FIXME: Extensions are not supported yet. Skip Step 8-9.
// Step 1, 3, 13 are handled by the caller.
// Step 2.
if (!sameOriginWithAncestors) {
@@ -177,6 +199,18 @@
if (options.rpId.isEmpty())
options.rpId = callerOrigin.host();
+ // Step 8-9.
+ // Only FIDO AppID Extension is supported.
+ if (options.extensions && !options.extensions->appid.isNull()) {
+ // The following implements https://www.w3.org/TR/webauthn/#sctn-appid-extension as of 4 March 2019.
+ auto appid = processAppIdExtension(callerOrigin, options.extensions->appid);
+ if (!appid) {
+ promise.reject(Exception { SecurityError, "The origin of the document is not authorized for the provided App ID."_s });
+ return;
+ }
+ options.extensions->appid = appid;
+ }
+
// Step 10-12.
auto clientDataJson = produceClientDataJson(ClientDataType::Get, options.challenge, callerOrigin);
auto clientDataJsonHash = produceClientDataJsonHash(clientDataJson);
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.cpp (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -40,11 +40,6 @@
namespace WebCore {
-Ref<PublicKeyCredential> PublicKeyCredential::create(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&& response)
-{
- return adoptRef(*new PublicKeyCredential(WTFMove(id), WTFMove(response)));
-}
-
RefPtr<PublicKeyCredential> PublicKeyCredential::tryCreate(const PublicKeyCredentialData& data)
{
if (!data.rawId || !data.clientDataJSON)
@@ -54,25 +49,26 @@
if (!data.attestationObject)
return nullptr;
- return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAttestationResponse::create(data.clientDataJSON.releaseNonNull(), data.attestationObject.releaseNonNull())));
+ return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAttestationResponse::create(data.clientDataJSON.releaseNonNull(), data.attestationObject.releaseNonNull()), { data.appid }));
}
if (!data.authenticatorData || !data.signature)
return nullptr;
- return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAssertionResponse::create(data.clientDataJSON.releaseNonNull(), data.authenticatorData.releaseNonNull(), data.signature.releaseNonNull(), WTFMove(data.userHandle))));
+ return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAssertionResponse::create(data.clientDataJSON.releaseNonNull(), data.authenticatorData.releaseNonNull(), data.signature.releaseNonNull(), WTFMove(data.userHandle)), { data.appid }));
}
-PublicKeyCredential::PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&& response)
+PublicKeyCredential::PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&& response, AuthenticationExtensionsClientOutputs&& extensions)
: BasicCredential(WTF::base64URLEncode(id->data(), id->byteLength()), Type::PublicKey, Discovery::Remote)
, m_rawId(WTFMove(id))
, m_response(WTFMove(response))
+ , m_extensions(WTFMove(extensions))
{
}
-ExceptionOr<bool> PublicKeyCredential::getClientExtensionResults() const
+PublicKeyCredential::AuthenticationExtensionsClientOutputs PublicKeyCredential::getClientExtensionResults() const
{
- return Exception { NotSupportedError };
+ return m_extensions;
}
void PublicKeyCredential::isUserVerifyingPlatformAuthenticatorAvailable(Document& document, DOMPromiseDeferred<IDLBoolean>&& promise)
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.h (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.h 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -42,23 +42,26 @@
class PublicKeyCredential final : public BasicCredential {
public:
- static Ref<PublicKeyCredential> create(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&&);
+ struct AuthenticationExtensionsClientOutputs {
+ Optional<bool> appid;
+ };
+
static RefPtr<PublicKeyCredential> tryCreate(const PublicKeyCredentialData&);
ArrayBuffer* rawId() const { return m_rawId.ptr(); }
AuthenticatorResponse* response() const { return m_response.ptr(); }
- // Not support yet. Always throws.
- ExceptionOr<bool> getClientExtensionResults() const;
+ AuthenticationExtensionsClientOutputs getClientExtensionResults() const;
static void isUserVerifyingPlatformAuthenticatorAvailable(Document&, DOMPromiseDeferred<IDLBoolean>&&);
private:
- PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&&);
+ PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&&, AuthenticationExtensionsClientOutputs&&);
Type credentialType() const final { return Type::PublicKey; }
Ref<ArrayBuffer> m_rawId;
Ref<AuthenticatorResponse> m_response;
+ AuthenticationExtensionsClientOutputs m_extensions;
};
} // namespace WebCore
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.idl (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.idl 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredential.idl 2019-03-20 06:11:57 UTC (rev 243193)
@@ -23,8 +23,6 @@
* THE POSSIBILITY OF SUCH DAMAGE.
*/
-typedef boolean AuthenticationExtensions;
-
[
Conditional=WEB_AUTHN,
EnabledAtRuntime=WebAuthentication,
@@ -33,7 +31,14 @@
] interface PublicKeyCredential : BasicCredential {
[SameObject] readonly attribute ArrayBuffer rawId;
[SameObject] readonly attribute AuthenticatorResponse response;
- [MayThrowException] AuthenticationExtensions getClientExtensionResults();
+ AuthenticationExtensionsClientOutputs getClientExtensionResults();
[CallWith=Document] static Promise<boolean> isUserVerifyingPlatformAuthenticatorAvailable();
};
+
+[
+ Conditional=WEB_AUTHN,
+ JSGenerateToJSObject,
+] dictionary AuthenticationExtensionsClientOutputs {
+ boolean appid;
+};
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.h (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.h 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -27,6 +27,7 @@
#if ENABLE(WEB_AUTHN)
+#include "AuthenticationExtensionsClientInputs.h"
#include "BufferSource.h"
#include "PublicKeyCredentialDescriptor.h"
#include "PublicKeyCredentialType.h"
@@ -83,6 +84,7 @@
Optional<unsigned> timeout;
Vector<PublicKeyCredentialDescriptor> excludeCredentials;
Optional<AuthenticatorSelectionCriteria> authenticatorSelection;
+ Optional<AuthenticationExtensionsClientInputs> extensions; // A place holder, but never used.
template<class Encoder> void encode(Encoder&) const;
template<class Decoder> static Optional<PublicKeyCredentialCreationOptions> decode(Decoder&);
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.idl (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.idl 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.idl 2019-03-20 06:11:57 UTC (rev 243193)
@@ -39,8 +39,7 @@
AuthenticatorSelectionCriteria authenticatorSelection;
// Always "direct" for us.
// AttestationConveyancePreference attestation = "none";
- // Not support yet.
- // AuthenticationExtensions extensions;
+ AuthenticationExtensionsClientInputs extensions;
};
[
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialData.h (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialData.h 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialData.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -49,6 +49,9 @@
mutable RefPtr<ArrayBuffer> signature;
mutable RefPtr<ArrayBuffer> userHandle;
+ // Extensions
+ Optional<bool> appid;
+
template<class Encoder> void encode(Encoder&) const;
template<class Decoder> static Optional<PublicKeyCredentialData> decode(Decoder&);
};
@@ -81,6 +84,9 @@
encoder << static_cast<uint64_t>(signature->byteLength());
encoder.encodeFixedLengthData(reinterpret_cast<const uint8_t*>(signature->data()), signature->byteLength(), 1);
+ // Encode AppID before user handle to avoid the userHandle flag.
+ encoder << appid;
+
if (!userHandle) {
encoder << false;
return;
@@ -148,6 +154,12 @@
if (!decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(result.signature->data()), signatureLength.value(), 1))
return WTF::nullopt;
+ Optional<Optional<bool>> appid;
+ decoder >> appid;
+ if (!appid)
+ return WTF::nullopt;
+ result.appid = WTFMove(*appid);
+
Optional<bool> hasUserHandle;
decoder >> hasUserHandle;
if (!hasUserHandle)
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.h (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.h 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -27,6 +27,7 @@
#if ENABLE(WEB_AUTHN)
+#include "AuthenticationExtensionsClientInputs.h"
#include "BufferSource.h"
#include "PublicKeyCredentialDescriptor.h"
#include "UserVerificationRequirement.h"
@@ -40,6 +41,7 @@
mutable String rpId;
Vector<PublicKeyCredentialDescriptor> allowCredentials;
UserVerificationRequirement userVerification { UserVerificationRequirement::Preferred };
+ mutable Optional<AuthenticationExtensionsClientInputs> extensions;
template<class Encoder> void encode(Encoder&) const;
template<class Decoder> static Optional<PublicKeyCredentialRequestOptions> decode(Decoder&);
@@ -49,7 +51,7 @@
template<class Encoder>
void PublicKeyCredentialRequestOptions::encode(Encoder& encoder) const
{
- encoder << timeout << rpId << allowCredentials << userVerification;
+ encoder << timeout << rpId << allowCredentials << userVerification << extensions;
}
template<class Decoder>
@@ -74,6 +76,12 @@
return WTF::nullopt;
result.userVerification = WTFMove(*userVerification);
+ Optional<Optional<AuthenticationExtensionsClientInputs>> extensions;
+ decoder >> extensions;
+ if (!extensions)
+ return WTF::nullopt;
+ result.extensions = WTFMove(*extensions);
+
return result;
}
Modified: trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl 2019-03-20 06:11:57 UTC (rev 243193)
@@ -31,6 +31,5 @@
USVString rpId;
sequence<PublicKeyCredentialDescriptor> allowCredentials = [];
UserVerificationRequirement userVerification = "preferred";
- // Not support yet.
- // AuthenticationExtensions extensions;
+ AuthenticationExtensionsClientInputs extensions;
};
Modified: trunk/Source/WebCore/Modules/webauthn/fido/DeviceResponseConverter.cpp (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/fido/DeviceResponseConverter.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/fido/DeviceResponseConverter.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -121,7 +121,7 @@
attestationObjectMap[CBOR("attStmt")] = WTFMove(attStmt);
auto attestationObject = cbor::CBORWriter::write(CBOR(WTFMove(attestationObjectMap)));
- return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.value().data(), attestationObject.value().size()), nullptr, nullptr, nullptr };
+ return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.value().data(), attestationObject.value().size()), nullptr, nullptr, nullptr, WTF::nullopt };
}
Optional<PublicKeyCredentialData> readCTAPGetAssertionResponse(const Vector<uint8_t>& inBuffer)
@@ -170,7 +170,7 @@
userHandle = ArrayBuffer::create(id.data(), id.size());
}
- return PublicKeyCredentialData { WTFMove(credentialId), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), WTFMove(userHandle) };
+ return PublicKeyCredentialData { WTFMove(credentialId), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), WTFMove(userHandle), WTF::nullopt };
}
Optional<AuthenticatorGetInfoResponse> readCTAPGetInfoResponse(const Vector<uint8_t>& inBuffer)
Modified: trunk/Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.cpp (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -114,12 +114,15 @@
return constructU2fSignCommand(produceRpIdHash(request.rp.id), clientDataHash, keyHandle.idVector, true /* checkOnly */);
}
-Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const PublicKeyCredentialRequestOptions& request, const Vector<uint8_t>& keyHandle, bool checkOnly)
+Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const PublicKeyCredentialRequestOptions& request, const Vector<uint8_t>& keyHandle, bool isAppId)
{
if (!isConvertibleToU2fSignCommand(request))
return WTF::nullopt;
- return constructU2fSignCommand(produceRpIdHash(request.rpId), clientDataHash, keyHandle, checkOnly);
+ if (!isAppId)
+ return constructU2fSignCommand(produceRpIdHash(request.rpId), clientDataHash, keyHandle, false);
+ ASSERT(request.extensions && !request.extensions->appid.isNull());
+ return constructU2fSignCommand(produceRpIdHash(request.extensions->appid), clientDataHash, keyHandle, false);
}
Vector<uint8_t> constructBogusU2fRegistrationCommand()
Modified: trunk/Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.h (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.h 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -62,7 +62,7 @@
WEBCORE_EXPORT Optional<Vector<uint8_t>> convertToU2fCheckOnlySignCommand(const Vector<uint8_t>& clientDataHash, const WebCore::PublicKeyCredentialCreationOptions&, const WebCore::PublicKeyCredentialDescriptor&);
// Extracts APDU encoded U2F sign command from PublicKeyCredentialRequestOptions.
-WEBCORE_EXPORT Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const WebCore::PublicKeyCredentialRequestOptions&, const Vector<uint8_t>& keyHandle, bool checkOnly = false);
+WEBCORE_EXPORT Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const WebCore::PublicKeyCredentialRequestOptions&, const Vector<uint8_t>& keyHandle, bool isAppId = false);
WEBCORE_EXPORT Vector<uint8_t> constructBogusU2fRegistrationCommand();
Modified: trunk/Source/WebCore/Modules/webauthn/fido/U2fResponseConverter.cpp (243192 => 243193)
--- trunk/Source/WebCore/Modules/webauthn/fido/U2fResponseConverter.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Modules/webauthn/fido/U2fResponseConverter.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -170,7 +170,7 @@
auto attestationObject = buildAttestationObject(WTFMove(authData), "fido-u2f", WTFMove(fidoAttestationStatement));
- return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr };
+ return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr, WTF::nullopt };
}
Optional<PublicKeyCredentialData> readU2fSignResponse(const String& rpId, const Vector<uint8_t>& keyHandle, const Vector<uint8_t>& u2fData)
@@ -186,7 +186,7 @@
counter += u2fData[counterIndex + 3];
auto authData = buildAuthData(rpId, flags, counter, { });
- return PublicKeyCredentialData { ArrayBuffer::create(keyHandle.data(), keyHandle.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(u2fData.data() + signatureIndex, u2fData.size() - signatureIndex), nullptr };
+ return PublicKeyCredentialData { ArrayBuffer::create(keyHandle.data(), keyHandle.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(u2fData.data() + signatureIndex, u2fData.size() - signatureIndex), nullptr, WTF::nullopt };
}
} // namespace fido
Modified: trunk/Source/WebCore/Sources.txt (243192 => 243193)
--- trunk/Source/WebCore/Sources.txt 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/Sources.txt 2019-03-20 06:11:57 UTC (rev 243193)
@@ -2567,6 +2567,7 @@
JSAudioNode.cpp
JSAudioParam.cpp
JSAudioProcessingEvent.cpp
+JSAuthenticationExtensionsClientInputs.cpp
JSAuthenticatorAssertionResponse.cpp
JSAuthenticatorAttestationResponse.cpp
JSAuthenticatorResponse.cpp
Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (243192 => 243193)
--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj 2019-03-20 06:11:57 UTC (rev 243193)
@@ -1864,6 +1864,7 @@
57D0018D1DD5413200ED19D9 /* JSCryptoKeyUsage.h in Headers */ = {isa = PBXBuildFile; fileRef = 57D0018C1DD5413200ED19D9 /* JSCryptoKeyUsage.h */; };
57D8462E1FEAF69900CA3682 /* PublicKeyCredential.h in Headers */ = {isa = PBXBuildFile; fileRef = 57D8462B1FEAF68F00CA3682 /* PublicKeyCredential.h */; settings = {ATTRIBUTES = (Private, ); }; };
57D846351FEAFCD300CA3682 /* JSPublicKeyCredential.h in Headers */ = {isa = PBXBuildFile; fileRef = 57D846301FEAFC2F00CA3682 /* JSPublicKeyCredential.h */; };
+ 57DA47B0224034E4002A4612 /* AuthenticationExtensionsClientInputs.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DA47A522401E0F002A4612 /* AuthenticationExtensionsClientInputs.h */; settings = {ATTRIBUTES = (Private, ); }; };
57DCED74214305F00016B847 /* PublicKeyCredentialData.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DCED72214305F00016B847 /* PublicKeyCredentialData.h */; settings = {ATTRIBUTES = (Private, ); }; };
57DCED9021487FF70016B847 /* AuthenticatorTransport.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DCED8C21487EDB0016B847 /* AuthenticatorTransport.h */; settings = {ATTRIBUTES = (Private, ); }; };
57DCED98214882160016B847 /* JSAuthenticatorTransport.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DCED92214880C60016B847 /* JSAuthenticatorTransport.h */; };
@@ -8865,6 +8866,10 @@
57D8462D1FEAF68F00CA3682 /* PublicKeyCredential.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = PublicKeyCredential.idl; sourceTree = "<group>"; };
57D846301FEAFC2F00CA3682 /* JSPublicKeyCredential.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPublicKeyCredential.h; sourceTree = "<group>"; };
57D846311FEAFC2F00CA3682 /* JSPublicKeyCredential.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPublicKeyCredential.cpp; sourceTree = "<group>"; };
+ 57DA47A522401E0F002A4612 /* AuthenticationExtensionsClientInputs.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = AuthenticationExtensionsClientInputs.h; sourceTree = "<group>"; };
+ 57DA47A722401E0F002A4612 /* AuthenticationExtensionsClientInputs.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = AuthenticationExtensionsClientInputs.idl; sourceTree = "<group>"; };
+ 57DA47AC224032DC002A4612 /* JSAuthenticationExtensionsClientInputs.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSAuthenticationExtensionsClientInputs.cpp; sourceTree = "<group>"; };
+ 57DA47AD224032DD002A4612 /* JSAuthenticationExtensionsClientInputs.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSAuthenticationExtensionsClientInputs.h; sourceTree = "<group>"; };
57DCED72214305F00016B847 /* PublicKeyCredentialData.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = PublicKeyCredentialData.h; sourceTree = "<group>"; };
57DCED8C21487EDB0016B847 /* AuthenticatorTransport.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = AuthenticatorTransport.h; sourceTree = "<group>"; };
57DCED8E21487EDB0016B847 /* AuthenticatorTransport.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = AuthenticatorTransport.idl; sourceTree = "<group>"; };
@@ -19879,6 +19884,8 @@
57152B5321CB2CE3000C37CA /* apdu */,
57303BB32006C6ED00355965 /* cbor */,
578A4BFA2166AE0000D08F34 /* fido */,
+ 57DA47A522401E0F002A4612 /* AuthenticationExtensionsClientInputs.h */,
+ 57DA47A722401E0F002A4612 /* AuthenticationExtensionsClientInputs.idl */,
57303C272009B2FC00355965 /* AuthenticatorAssertionResponse.h */,
57303C292009B2FC00355965 /* AuthenticatorAssertionResponse.idl */,
57303C1B2009A98600355965 /* AuthenticatorAttestationResponse.h */,
@@ -19915,6 +19922,8 @@
57D8462F1FEAFB0500CA3682 /* WebAuthN */ = {
isa = PBXGroup;
children = (
+ 57DA47AC224032DC002A4612 /* JSAuthenticationExtensionsClientInputs.cpp */,
+ 57DA47AD224032DD002A4612 /* JSAuthenticationExtensionsClientInputs.h */,
57303C2E2009B7DA00355965 /* JSAuthenticatorAssertionResponse.cpp */,
57303C2D2009B7D900355965 /* JSAuthenticatorAssertionResponse.h */,
57303C202009AEF500355965 /* JSAuthenticatorAttestationResponse.cpp */,
@@ -28608,6 +28617,7 @@
7EE6846112D26E3800E79415 /* AuthenticationChallenge.h in Headers */,
934F713A0D5A6F1000018D69 /* AuthenticationChallengeBase.h in Headers */,
E124748410AA161D00B79493 /* AuthenticationClient.h in Headers */,
+ 57DA47B0224034E4002A4612 /* AuthenticationExtensionsClientInputs.h in Headers */,
514C764C0CE9234E007EF3CD /* AuthenticationMac.h in Headers */,
57303C2C2009B4A800355965 /* AuthenticatorAssertionResponse.h in Headers */,
57303C1F2009AB4200355965 /* AuthenticatorAttestationResponse.h in Headers */,
Modified: trunk/Source/WebKit/ChangeLog (243192 => 243193)
--- trunk/Source/WebKit/ChangeLog 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebKit/ChangeLog 2019-03-20 06:11:57 UTC (rev 243193)
@@ -1,3 +1,24 @@
+2019-03-19 Jiewen Tan <[email protected]>
+
+ [WebAuthN] Implement FIDO AppID extension
+ https://bugs.webkit.org/show_bug.cgi?id=143491
+ <rdar://problem/48298273>
+
+ Reviewed by Brent Fulgham.
+
+ In U2fHidAuthenticator::continueSignCommandAfterResponseReceived, it will retry the current command
+ with the AppID if it exists when SW_WRONG_DATA is received from devices. Noted, it will not set
+ the AuthenticationExtensionsClientOutputs::appid to false in any circumstances. In other words, the
+ field will be empty if AppID is supplied in AuthenticationExtensionsClientInputs and not used.
+
+ * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
+ (WebKit::LocalAuthenticator::continueMakeCredentialAfterAttested):
+ (WebKit::LocalAuthenticator::continueGetAssertionAfterUserConsented):
+ * UIProcess/WebAuthentication/fido/U2fHidAuthenticator.cpp:
+ (WebKit::U2fHidAuthenticator::issueSignCommand):
+ (WebKit::U2fHidAuthenticator::continueSignCommandAfterResponseReceived):
+ * UIProcess/WebAuthentication/fido/U2fHidAuthenticator.h:
+
2019-03-19 Ross Kirsling <[email protected]>
Unreviewed adjustment to r242842 per Darin's request.
Modified: trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm (243192 => 243193)
--- trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm 2019-03-20 06:11:57 UTC (rev 243193)
@@ -326,7 +326,7 @@
}
auto attestationObject = buildAttestationObject(WTFMove(authData), "Apple", WTFMove(attestationStatementMap));
- receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr });
+ receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr, WTF::nullopt });
#endif // !PLATFORM(IOS_FAMILY)
}
@@ -463,7 +463,7 @@
}
// Step 13.
- receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), ArrayBuffer::create(userhandle.data(), userhandle.size()) });
+ receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), ArrayBuffer::create(userhandle.data(), userhandle.size()), WTF::nullopt });
#endif // !PLATFORM(IOS_FAMILY)
}
Modified: trunk/Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.cpp (243192 => 243193)
--- trunk/Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -101,7 +101,7 @@
receiveRespond(ExceptionData { NotAllowedError, "No credentials from the allowCredentials list is found in the authenticator."_s });
return;
}
- auto u2fCmd = convertToU2fSignCommand(requestData().hash, requestData().requestOptions, requestData().requestOptions.allowCredentials[index].idVector);
+ auto u2fCmd = convertToU2fSignCommand(requestData().hash, requestData().requestOptions, requestData().requestOptions.allowCredentials[index].idVector, m_isAppId);
ASSERT(u2fCmd);
issueNewCommand(WTFMove(*u2fCmd), CommandType::SignCommand);
}
@@ -200,11 +200,19 @@
{
switch (apduResponse.status()) {
case ApduResponse::Status::SW_NO_ERROR: {
- auto response = readU2fSignResponse(requestData().requestOptions.rpId, requestData().requestOptions.allowCredentials[m_nextListIndex - 1].idVector, apduResponse.data());
+ Optional<PublicKeyCredentialData> response;
+ if (m_isAppId) {
+ ASSERT(requestData().requestOptions.extensions && !requestData().requestOptions.extensions->appid.isNull());
+ response = readU2fSignResponse(requestData().requestOptions.extensions->appid, requestData().requestOptions.allowCredentials[m_nextListIndex - 1].idVector, apduResponse.data());
+ } else
+ response = readU2fSignResponse(requestData().requestOptions.rpId, requestData().requestOptions.allowCredentials[m_nextListIndex - 1].idVector, apduResponse.data());
if (!response) {
receiveRespond(ExceptionData { UnknownError, "Couldn't parse the U2F sign response."_s });
return;
}
+ if (m_isAppId)
+ response->appid = m_isAppId;
+
receiveRespond(WTFMove(*response));
return;
}
@@ -212,6 +220,17 @@
// Polling is required during test of user presence.
m_retryTimer.startOneShot(Seconds::fromMilliseconds(retryTimeOutValueMs));
return;
+ case ApduResponse::Status::SW_WRONG_DATA:
+ if (requestData().requestOptions.extensions && !requestData().requestOptions.extensions->appid.isNull()) {
+ if (!m_isAppId) {
+ m_isAppId = true;
+ issueSignCommand(m_nextListIndex - 1);
+ return;
+ }
+ m_isAppId = false;
+ }
+ issueSignCommand(m_nextListIndex++);
+ return;
default:
issueSignCommand(m_nextListIndex++);
}
Modified: trunk/Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.h (243192 => 243193)
--- trunk/Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.h 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -74,6 +74,7 @@
Vector<uint8_t> m_lastCommand;
CommandType m_lastCommandType;
size_t m_nextListIndex { 0 };
+ bool m_isAppId { false };
};
} // namespace WebKit
Modified: trunk/Tools/ChangeLog (243192 => 243193)
--- trunk/Tools/ChangeLog 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Tools/ChangeLog 2019-03-20 06:11:57 UTC (rev 243193)
@@ -1,3 +1,19 @@
+2019-03-19 Jiewen Tan <[email protected]>
+
+ [WebAuthN] Implement FIDO AppID extension
+ https://bugs.webkit.org/show_bug.cgi?id=143491
+ <rdar://problem/48298273>
+
+ Reviewed by Brent Fulgham.
+
+ Add a test that covers the new flag of convertToU2fSignCommand.
+
+ * TestWebKitAPI/Tests/WebCore/CtapRequestTest.cpp:
+ (TestWebKitAPI::TEST):
+ * TestWebKitAPI/Tests/WebCore/FidoTestData.h:
+ * TestWebKitAPI/Tests/WebCore/U2fCommandConstructorTest.cpp:
+ (TestWebKitAPI::TEST):
+
2019-03-19 Keith Rollin <[email protected]>
Add support for more platforms to generate-xcfilelists
Modified: trunk/Tools/TestWebKitAPI/Tests/WebCore/CtapRequestTest.cpp (243192 => 243193)
--- trunk/Tools/TestWebKitAPI/Tests/WebCore/CtapRequestTest.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Tools/TestWebKitAPI/Tests/WebCore/CtapRequestTest.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -59,7 +59,7 @@
Vector<PublicKeyCredentialCreationOptions::Parameters> params { { PublicKeyCredentialType::PublicKey, 7 }, { PublicKeyCredentialType::PublicKey, 257 } };
PublicKeyCredentialCreationOptions::AuthenticatorSelectionCriteria selection { PublicKeyCredentialCreationOptions::AuthenticatorAttachment::Platform, true, UserVerificationRequirement::Preferred };
- PublicKeyCredentialCreationOptions options { rp, user, { }, params, WTF::nullopt, { }, selection };
+ PublicKeyCredentialCreationOptions options { rp, user, { }, params, WTF::nullopt, { }, selection, WTF::nullopt };
Vector<uint8_t> hash;
hash.append(TestData::kClientDataHash, sizeof(TestData::kClientDataHash));
auto serializedData = encodeMakeCredenitalRequestAsCBOR(hash, options, AuthenticatorSupportedOptions::UserVerificationAvailability::kSupportedButNotConfigured);
Modified: trunk/Tools/TestWebKitAPI/Tests/WebCore/FidoTestData.h (243192 => 243193)
--- trunk/Tools/TestWebKitAPI/Tests/WebCore/FidoTestData.h 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Tools/TestWebKitAPI/Tests/WebCore/FidoTestData.h 2019-03-20 06:11:57 UTC (rev 243193)
@@ -113,6 +113,32 @@
0x00, 0x00,
};
+constexpr uint8_t kU2fAppIDSignCommandApdu[] = {
+ // CLA, INS, P1, P2 APDU instruction parameters
+ 0x00, 0x02, 0x03, 0x00,
+ // Data Length (3 bytes in big endian order)
+ 0x00, 0x00, 0x81,
+ // Challenge parameter -- see kClientDataHash
+ 0x68, 0x71, 0x34, 0x96, 0x82, 0x22, 0xec, 0x17, 0x20, 0x2e, 0x42,
+ 0x50, 0x5f, 0x8e, 0xd2, 0xb1, 0x6a, 0xe2, 0x2f, 0x16, 0xbb, 0x05,
+ 0xb8, 0x8c, 0x25, 0xdb, 0x9e, 0x60, 0x26, 0x45, 0xf1, 0x41,
+ // Application parameter
+ 0xc9, 0x34, 0x02, 0x87, 0x08, 0x3d, 0x64, 0xde, 0xed, 0x17, 0x1b, 0xbb,
+ 0xd7, 0x60, 0x10, 0xae, 0xc5, 0x65, 0x3e, 0x78, 0xfc, 0xd0, 0x31, 0x88,
+ 0xd0, 0xbf, 0x70, 0x16, 0x9a, 0x46, 0x91, 0xda,
+ // Key handle length
+ 0x40,
+ // Key handle
+ 0x3E, 0xBD, 0x89, 0xBF, 0x77, 0xEC, 0x50, 0x97, 0x55, 0xEE, 0x9C, 0x26,
+ 0x35, 0xEF, 0xAA, 0xAC, 0x7B, 0x2B, 0x9C, 0x5C, 0xEF, 0x17, 0x36, 0xC3,
+ 0x71, 0x7D, 0xA4, 0x85, 0x34, 0xC8, 0xC6, 0xB6, 0x54, 0xD7, 0xFF, 0x94,
+ 0x5F, 0x50, 0xB5, 0xCC, 0x4E, 0x78, 0x05, 0x5B, 0xDD, 0x39, 0x6B, 0x64,
+ 0xF7, 0x8D, 0xA2, 0xC5, 0xF9, 0x62, 0x00, 0xCC, 0xD4, 0x15, 0xCD, 0x08,
+ 0xFE, 0x42, 0x00, 0x38,
+ // Max response length
+ 0x00, 0x00,
+};
+
constexpr uint8_t kU2fCheckOnlySignCommandApdu[] = {
// CLA, INS, P1, P2 APDU instruction parameters
0x00, 0x02, 0x07, 0x00,
Modified: trunk/Tools/TestWebKitAPI/Tests/WebCore/U2fCommandConstructorTest.cpp (243192 => 243193)
--- trunk/Tools/TestWebKitAPI/Tests/WebCore/U2fCommandConstructorTest.cpp 2019-03-20 05:40:11 UTC (rev 243192)
+++ trunk/Tools/TestWebKitAPI/Tests/WebCore/U2fCommandConstructorTest.cpp 2019-03-20 06:11:57 UTC (rev 243193)
@@ -176,6 +176,27 @@
EXPECT_EQ(*u2fSignCommand, convertBytesToVector(TestData::kU2fSignCommandApdu, sizeof(TestData::kU2fSignCommandApdu)));
}
+TEST(U2fCommandConstructorTest, TestConvertCtapGetAssertionWithAppIDToU2fSignRequest)
+{
+ auto getAssertionReq = constructGetAssertionRequest();
+ PublicKeyCredentialDescriptor credentialDescriptor;
+ credentialDescriptor.type = PublicKeyCredentialType::PublicKey;
+ credentialDescriptor.idVector = convertBytesToVector(TestData::kU2fSignKeyHandle, sizeof(TestData::kU2fSignKeyHandle));
+ Vector<PublicKeyCredentialDescriptor> allowedList;
+ allowedList.append(WTFMove(credentialDescriptor));
+ getAssertionReq.allowCredentials = WTFMove(allowedList);
+ EXPECT_TRUE(isConvertibleToU2fSignCommand(getAssertionReq));
+
+ // AppID
+ WebCore::AuthenticationExtensionsClientInputs extensions;
+ extensions.appid = "https://www.example.com/appid";
+ getAssertionReq.extensions = WTFMove(extensions);
+
+ const auto u2fSignCommand = convertToU2fSignCommand(convertBytesToVector(TestData::kClientDataHash, sizeof(TestData::kClientDataHash)), getAssertionReq, convertBytesToVector(TestData::kU2fSignKeyHandle, sizeof(TestData::kU2fSignKeyHandle)), true);
+ ASSERT_TRUE(u2fSignCommand);
+ EXPECT_EQ(*u2fSignCommand, convertBytesToVector(TestData::kU2fAppIDSignCommandApdu, sizeof(TestData::kU2fAppIDSignCommandApdu)));
+}
+
TEST(U2fCommandConstructorTest, TestU2fSignAllowListRequirement)
{
auto getAssertionReq = constructGetAssertionRequest();
