search

MasterKale / SimpleWebAuthn

WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.
https://simplewebauthn.dev
MIT License
1.62k stars 137 forks source link

fix/613-cross-origin-flag-verification #624

Closed MasterKale closed 1 month ago

MasterKale commented 1 month ago

This PR adds verification of the clientDataJSON.crossOrigin value, when present. RPs can use the new allowEmbeddedRegistration and allowEmbeddedAuthentication options in their corresponding verify...Response() methods to fail verification if crossOrigin is present and true when the RP does not expect the site to be embedded on a different site.

Fixes #613.