From: Roeland Jago Douma <roeland@famdouma.nl>
Date: Thu, 16 Jul 2020 19:10:07 +0000 (+0200)
Subject: Discourage webauthn user interaction
X-Git-Tag: v20.0.0beta1~213^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=884f3d009a8b81422b1f9275a21d5b125066af73;p=nextcloud-server.git

Discourage webauthn user interaction

Else people might have the feeling this is also doing 2FA. And since it
is only prefered it can be ignored and hacked around.

Once we have proper 2FA with webauthn in one go this probably needs to
be revisted.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
---

diff --git a/lib/private/Authentication/WebAuthn/Manager.php b/lib/private/Authentication/WebAuthn/Manager.php
index cc3e9aba1cc..4415badc9b0 100644
--- a/lib/private/Authentication/WebAuthn/Manager.php
+++ b/lib/private/Authentication/WebAuthn/Manager.php
@@ -107,7 +107,11 @@ class Manager {
 		$excludedPublicKeyDescriptors = [
 		];
 
-		$authenticatorSelectionCriteria = new AuthenticatorSelectionCriteria();
+		$authenticatorSelectionCriteria = new AuthenticatorSelectionCriteria(
+			null,
+			false,
+			AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
+		);
 
 		return new PublicKeyCredentialCreationOptions(
 			$rpEntity,
@@ -186,7 +190,8 @@ class Manager {
 			random_bytes(32),                                                    // Challenge
 			60000,                                                              // Timeout
 			$this->stripPort($serverHost),                                                                  // Relying Party ID
-			$registeredPublicKeyCredentialDescriptors                                  // Registered PublicKeyCredentialDescriptor classes
+			$registeredPublicKeyCredentialDescriptors,                                  // Registered PublicKeyCredentialDescriptor classes
+			AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
 		);
 	}