search

kanidm / webauthn-rs

An implementation of webauthn components for Rustlang servers
Mozilla Public License 2.0
483 stars 80 forks source link

Enforcing Timeouts in webauthn-rs #383

Open smessmer opened 10 months ago

smessmer commented 10 months ago

Is your feature request related to a problem? Please describe. webauthn-rs currently does not enforce timeouts besides adding them to the challenge json, which means developers using the library have to make sure they check for timeouts themselves to prevent security issues where old challenges come back to haunt them. Not a big issue for us, we did add that code, but this seems like a potential security pitfall for developers. It might help some developers if webauthn-rs enforced the timeout on the server side.

Describe the solution you'd like PasskeyAuthentication and PasskeyRegistration could remember when they were created, and the timeout would be enforced when the flow finishes.

Describe alternatives you've considered Having developers using webauthn-rs check timeouts in their code. Works, but could be a security issue if they forget.

Firstyear commented 10 months ago

I think that's reasonable. The challenge will be doing this in a way that's stable so we likely need to store the time relative to unix epoch in the reg/auth parts. This would likely be a change to webauthn-rs-core infact rather than webauthn-rs so it fixes it for all users.