microsoft/webauthntest

WebAuthn Test Site

Live instance

A live instance of this code is available at aka.ms/webauthntest. This instance is for testing the WebAuthn API only. Do not submit personal data.

Deploying a local instance

1. Download and install the latest NodeJS
2. Download and install VS Code
3. Download and install MongoDB Community
4. Clone this repository
5. Run npm install in the root directory
6. Open this repository in VS Code
7. Launch program - configurations should already be set

Deploying to production

Things you need to deploy

• Create a app services web project
• Create a Cosmos DB with API mongodb

Before deploying, you'll need to define the following environment variables inside app services application settings so they can be accessed by this NODEJS app at runtime:

• MONGODB_URL - connection URL to your mongodb. Get it from cosmos db settings. Pick the latest Node.js 3.0 connection string under quick start.
• JWT_SECRET - some long random string
• HOSTNAME - hostname of your deployed service (e.g. "webauthntestapp.azurewebsites.net")
• ENFORCE_SSL_AZURE - set to "true"

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repositories using our CLA.

Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

webauthntest's Issues

"Attestation Statement Chain" show content of last time when using authenticator of self attestation to enroll

https://webauthntest.azurewebsites.net/
Logon with any user name.

Reproduce:

1. Create credential with an authenticator which uses batch attestation certificate.
2. Check "Attestation Statement Chain" showed on "Credential Creation Data" page. ( click "[more details]" beside "Credential Registration Data" )
3. Create credential again with another authenticator which uses Self Attestation(surrogate basic attestation).
4. Check "Attestation Statement Chain" .

Issue: Attestation Statement Chain in step4 is same as step 2.

Show the current username somewhere

Show the current username of the session somewhere in the UI

This repo is missing important files

There are important files that Microsoft projects should all have that are not present in this repository. A pull request has been opened to add the missing file(s). When the pr is merged this issue will be closed automatically.

Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.

Merge this pull request

Add support for PRF extension

https://w3c.github.io/webauthn/#prf

Add support for SPK

Add support for WebAuthn L3 supplemental public keys

cbor.decodeFirstSync will failed and throw errors if there is extra data.

Seems due to recent node-cbor module update in this project. And below is related information.
hildjj/node-cbor#118 (comment)

This will cause authenticator data parsing failed if there is any extra extension data.

Allow overriding transports during getAssertion

Provide the ability to override transports during getAssertion requests

Store transports

We should store transports and display them with the credential

Update runtime to Node 18 LTS