[PM-11884] Perform origin validation during FIDO 2 auth

SaintPatrck commented 3 weeks ago

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-11884

📔 Objective

Perform origin and asset link validation during the FIDO 2 credential authentication process.

If the request originates from a privileged application (web browser on behalf of RP), the calling app is validated against our internal allow list.

If the request originates from an unprivileged RP application the RP's asset link is used to validate the application's authenticity.

If origin or asset link validation is unsuccessful for any reason, the user is notified and the operation is terminated according to the WebAuthn spec.

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation or informed the documentation team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

github-actions[bot] commented 3 weeks ago

Checkmarx One – Scan Summary & Details – 8125249f-f413-4b55-b8ac-424974064e88

No New Or Fixed Issues Found

codecov[bot] commented 3 weeks ago

Codecov Report

Attention: Patch coverage is 93.58974% with 5 lines in your changes missing coverage. Please review.

Project coverage is 88.69%. Comparing base (4c1d55e) to head (11b9259). Report is 15 commits behind head on main.

Files with missing lines	Patch %	Lines
...tofill/fido2/manager/Fido2CredentialManagerImpl.kt	89.65%	0 Missing and 3 partials :warning:
...t/feature/itemlisting/VaultItemListingViewModel.kt	95.91%	0 Missing and 2 partials :warning:

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #3896 +/- ## ========================================== - Coverage 88.69% 88.69% -0.01% ========================================== Files 418 418 Lines 34051 34068 +17 Branches 5024 5034 +10 ========================================== + Hits 30202 30216 +14 Misses 2090 2090 - Partials 1759 1762 +3 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

bitwarden / android