duo-labs / py_webauthn

Pythonic WebAuthn 🐍
https://duo-labs.github.io/py_webauthn
BSD 3-Clause "New" or "Revised" License
856 stars 171 forks source link

safetynet-time-drift #107

Closed MasterKale closed 2 years ago

MasterKale commented 2 years ago

Natural time drift between RP and Google SafetyNet API is inevitable, even if it's just a few hundred milliseconds. Unfortunately the library is too strict on timing and will error out on a SafetyNet response that appears to be even a millisecond from the future.

This diff addresses this problem by checking that a SafetyNet response originated sometime between "now +/- 10 seconds".

Addresses #106.