Closed MordiSacks closed 6 months ago
As a work around I did this
public function login(Request $request, AssertionValidator $assertion): Response
{
/** @var User $user */
$user = Auth::guard('web')->user();
$key = $user->webAuthnCredentials()->whereKey($request->json('id'))->first();
$request->json()->set('response', ['userHandle' => $key?->user_id ?? ''] + $request->json('response'));
$credential = $assertion
->send(new AssertionValidation($request))
->thenReturn()
->credential;
if (!$credential) return \response()->noContent(422);
session(['webauthn' => true]);
return response()->noContent();
}
The user is available in this context as I'm using this package as 2FA, and the user reaches this page after password login However as I'm not fluent with webauthn spec, this might introduce a vulnerability, use under own discretion!
Fixed in #52
PHP & Platform
8.2.7 Ubuntu 22.04.2
Database
MariaDB 10.10.5
Laravel version
10.14.1
Browser
Google Chrome 114.0.5735.198
Have you done this?
Expectation
Not sure
Description
When logging in the response from the browser
publicKeyCredential.response
containsuserHandle: ''
not sure why its empty but it ise (I checked on a few other site using webauthn, and it's empty there also).
However in the database the
user_id
field is populated,In
Laragear\WebAuthn\Assertion\Validator\Pipes\CheckCredentialIsForUser::validateId
there is a check againest user_id on the credentials model, this throws an exception when handle is empty.Reproduction
Stack trace & logs