From 2f766082214e8f10375a68323e6b7bb1c742775d Mon Sep 17 00:00:00 2001 From: zeripath Date: Wed, 9 Feb 2022 07:37:58 +0000 Subject: Prevent security failure due to bad APP_ID (#18678) WebAuthn may cause a security exception if the provided APP_ID is not allowed for the current origin. Therefore we should reattempt authentication without the appid extension. Also we should allow [u2f] as-well as [U2F] sections. Signed-off-by: Andrew Thornton Co-authored-by: Lunny Xiao --- web_src/js/features/user-auth-webauthn.js | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'web_src/js/features') diff --git a/web_src/js/features/user-auth-webauthn.js b/web_src/js/features/user-auth-webauthn.js index 4cb8c18219..f11a49864d 100644 --- a/web_src/js/features/user-auth-webauthn.js +++ b/web_src/js/features/user-auth-webauthn.js @@ -24,6 +24,19 @@ export function initUserAuthWebAuthn() { .then((credential) => { verifyAssertion(credential); }).catch((err) => { + // Try again... without the appid + if (makeAssertionOptions.publicKey.extensions && makeAssertionOptions.publicKey.extensions.appid) { + delete makeAssertionOptions.publicKey.extensions['appid']; + navigator.credentials.get({ + publicKey: makeAssertionOptions.publicKey + }) + .then((credential) => { + verifyAssertion(credential); + }).catch((err) => { + webAuthnError('general', err.message); + }); + return; + } webAuthnError('general', err.message); }); }).fail(() => { -- cgit v1.2.3