search

cedarcode / webauthn-ruby

WebAuthn ruby server library ― Make your Ruby/Rails web server become a conformant WebAuthn Relying Party
https://rubygems.org/gems/webauthn
MIT License
644 stars 51 forks source link

added userPresence check with userVerification = true #418

Open cheeeeenais opened 7 months ago

cheeeeenais commented 7 months ago

User Presence check is not checked in case User Verification is true.

santiagorodriguez96 commented 6 months ago

Seems like this is intended: https://github.com/cedarcode/webauthn-ruby/pull/74

I'm wondering... would it be possible for a response to have the UV set without having the UP flag set?

According to this thread that shouldn't be possible 🤔

santiagorodriguez96 commented 6 months ago

Having said that I do think it makes sense to follow the Webauthn spec and always require the UP bit to be set.

I'm just trying to understand if this is actually a critical issue or not 🙂

cheeeeenais commented 6 months ago

Hey Santiago,It seems like nobody actually knows what UP is intended to be, as the specification is also rather vague. I think for completeness you can follow the standard by verifying always only UP (or by adding the UP=0 and UV=1 check). I don't believe this is anything critical. Am I allowed to publish this finding in my research work? Thanks in advance! Peizhou ChenOn 26 Jan 2024, at 19:58, Santiago Rodriguez @.***> wrote: Having said that I do think it makes sense to follow the Webauthn spec and always require the UP bit to be set. I'm just trying to understand if this is actually a critical issue or not 🙂

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: @.***>

santiagorodriguez96 commented 6 months ago

Am I allowed to publish this finding in my research work?

Yeah, for sure!