search

MasterKale / SimpleWebAuthn

WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.
https://simplewebauthn.dev
MIT License
1.62k stars 137 forks source link

Library does not check algorithm in specific case. #248

Closed lightpurple closed 2 years ago

lightpurple commented 2 years ago

We developed Server using simpleWebAuthn(5.4.2) library. Test by FIDO Conformance Tools 1.7.2

And I found that library no algorithm check when the fmt value is 'packed' and the x5c value exists.

So there are successful cases even if the algorithm value not allowed in the fido2. ex) alg = -42

image

Can you give some suggestions to solve this?

MasterKale commented 2 years ago

Thanks for reporting this, I have a fix for it out in #251. I'll merge it later today and release this with the fix for #247.

MasterKale commented 2 years ago

The fix for this is now available in @simplewebauthn/server@5.4.4.