search

eclipse-vertx / vertx-auth

Apache License 2.0
160 stars 153 forks source link

Remove AAGUID check from NoneAttestation #671

Closed ynojima closed 6 months ago

ynojima commented 7 months ago

Remove AAGUID check from NoneAttestation because it is not required by WebAuthn specification and FIDO conformance tool.

Also, this check blocks Apple's passkey and Google Password Manager's passkey. See https://github.com/quarkusio/quarkus/issues/38043

FroMage commented 7 months ago

The reason is that authenticator implementors stopped sending zeroed AAGUIDs, so this prevents people from using webauthn.

ynojima commented 6 months ago

Rebased to pull https://github.com/eclipse-vertx/vertx-auth/pull/672 changes

FroMage commented 6 months ago

@vietj or @tsegismont can we get this moving please?

vietj commented 6 months ago

sure I'll review these PR

vietj commented 6 months ago

can you backport this to 4.x @ynojima ?

ynojima commented 6 months ago

I'm not familiar with vertx development. To which branch or repository should I send a backport pull-request regarding 4.x?

FroMage commented 6 months ago

Thanks @vietj

FroMage commented 2 months ago

@vietj which version of Vert.x did this make it to? @StephenOTT says they still have the issue on latest Quarkus with Vert.x 4.5.7