search

eclipse-vertx / vertx-auth

Apache License 2.0
166 stars 156 forks source link

vertx-auth-webauthn4j doesn't verify AttestationStatement when Attestation.DIRECT or Attestation.INDRECT is specified #696

Closed ynojima closed 4 days ago

ynojima commented 1 week ago

https://github.com/eclipse-vertx/vertx-auth/blob/f2d60e09b724d9e01e170279b375b888d4a7e55e/vertx-auth-webauthn4j/src/main/java/io/vertx/ext/auth/webauthn4j/impl/WebAuthn4JImpl.java#L144

Attestation statement is returned for Attestation.DIRECT or Attestation.INDRECT too. To check the attestation Attestation.DIRECT is the first choice, and the use of Attestation.ENTERPRISE is limited to very specific use cases(https://developers.yubico.com/WebAuthn/Concepts/Enterprise_Attestation/).

This should be 

if(options.getAttestation() != Attestation.NONE) {

See also: https://github.com/quarkusio/quarkus/pull/44105#pullrequestreview-2403708793