search

tweag / webauthn

A library for parsing and validating webauthn/fido2 credentials
Apache License 2.0
34 stars 11 forks source link

Pass a list of allowed origins instead of a single origin #184

Closed arianvp closed 3 months ago

arianvp commented 3 months ago

Android and iOS also support WebAuthn just like browsers.

The apps will use their AppStore/PlayStore AppID as the origin. This means we need to allow a list of origins instead of a single origin.

Apple uses https://developer.apple.com/documentation/xcode/supporting-associated-domains to link the app origin to the RpId

Google uses an assetlinks.json file: https://developers.google.com/identity/fido/android/native-apps#interoperability_with_your_website

infinisil commented 3 months ago

Multiple origins looks like a Webauthn 3 (which is still a draft) specific notion, see https://www.w3.org/TR/webauthn-3/#sctn-validating-origin, this doesn't seem to be documented in Webauthn 2.

This library currently only implements Webauthn 2, but this seems very benign, and since it's already used in practice, it sounds fine to add.

Please add some comments to the code/docs to explain this context.

infinisil commented 3 months ago

Would also be neat to have a test with two origins ;)

arianvp commented 3 months ago

I added some quickcheck properties now. Hope this suffices? :D PTAL