cedarcode / webauthn-ruby

WebAuthn ruby server library ― Make your Ruby/Rails web server become a conformant WebAuthn Relying Party
https://rubygems.org/gems/webauthn
MIT License
649 stars 53 forks source link

Following example throws an error #329

Closed kevinchugh closed 4 years ago

kevinchugh commented 4 years ago

Hi, trying to follow the readme, I do:

webauthn_credential = WebAuthn::Credential.from_get(response)

response is

{"authenticatorData"=>"SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MBAAAD9w", "clientDataJSON"=> "eyJjaGFsbGVuZ2UiOiJxT3poSDhtYWFqdUU5b1hZcTFtajF0SGhmMFp1RldYVmdJaU9wVFc1VUlBIiwiY2xpZW50RXh0ZW5zaW9ucyI6e30sImhhc2hBbGdvcml0aG0iOiJTSEEtMjU2Iiwib3JpZ2luIjoiaHR0cDovL2xvY2FsaG9zdDozMDAwIiwidHlwZSI6IndlYmF1dGhuLmdldCJ9", "signature"=>"MEUCIQDaCA-jUr3IuHlJgzTW3bbmDKBQkV1bNFfDuImJSflCYAIgROJBWX438POJCozW5B5tSBJzdu_v_aEgqkgcge4nCnU", "userHandle"=>"none", "rawId"=>"tb8E60kMtm_pVBvKFORTlcaBrbrcoTYWF5WZgV9VK7ZkQLHQeBvw0VSJUQW1NqUCcjaAJL21l4LdxOqaLYKqdQ", "clientExtensionResults"=>""}

I get

undefined method[]' for nil:NilClass from /home/kevin/.rvm/gems/ruby-2.5.0/gems/webauthn-2.2.1/lib/webauthn/authenticator_assertion_response.rb:19:in from_client'

Cannot figure out what's going on, anything jump out at you? Thanks for any help.

santiagorodriguez96 commented 4 years ago

Hi! Glad to hear that you are giving a try to our gem!

The problem here is that you're passing response directly as input to the from_get method, when actually, as defined in the spec, it expects a hash-like object that represents a PublicKeyCredential Interface object.

The PublicKeyCredential interface inherits from Credential [CREDENTIAL-MANAGEMENT-1], and contains the attributes that are returned to the caller when a new credential is created, or a new assertion is requested.

Note that response is one the couple of attributes that the PublicKeyCredential Interface object should have 🙂

May I ask, how are you doing for building the response in the client before sending it back to the server? As you can see in the README, we suggest the use of WebAuthn-JSON package which is able to build the PublicKeyCredential Interface object that you can later send back to the server. If you wish, you can take a look at the source code of our WebAuthn Demo App, where you can take a look at how we use this package for doing this – and more!

grzuy commented 4 years ago

@kevinchugh Hope your question is answered.

Let us know if you still have any issues.