morris295/node-webauthn

A webauthn server library written in node.js

node-webauthn

A webauthn server written in node.js

WebAuthn protocol documentation
FIDO Alliance FIDO2.0 documentation

node-webauthn's Issues

Create Attestation/Assertion response types

Create response types to serve as parameters to result methods in Fido2 services. Should inherit from a parent ServerAuthenticatorResponse type, parent type can be empty.

Dictionary definitions per FIDO docs:

dictionary ServerAuthenticatorAttestationResponse : ServerAuthenticatorResponse {
    required DOMString      clientDataJSON;
    required DOMString      attestationObject;
};

dictionary ServerAuthenticatorAssertionResponse : ServerAuthenticatorResponse {
    required DOMString      clientDataJSON;
    required DOMString      authenticatorData;
    required DOMString      signature;
    required DOMString      userHandle;
};

Rename isBase64Encoded function

"isBase64Encoded" function really should be renamed to "isBase64UrlEncoded" as it's specifically checking for that, would help to avoid confusion.

node-webauthn/src/Utilities/Base64Utility.ts

Line 4 in 5963174

public static isBase64Encoded(value: string) {

Create Attestation/Assertion request types

Instead of using requests of type "any", types should be created for attestation and assertion requests.

E.G. From Fido docs:

dictionary ServerPublicKeyCredentialCreationOptionsRequest {
        required DOMString              username;
        required DOMString              displayName;
        AuthenticatorSelectionCriteria  authenticatorSelection;
        AttestationConveyancePreference attestation = "none";
    };

dictionary ServerPublicKeyCredentialGetOptionsRequest {
        required DOMString              username;
        UserVerificationRequirement     userVerification = "preferred";
    };

Remove duplicate algorithm identifier

Remove duplicate algorithm identifier "-37": "SHA512", in COSE Algorithm switch. Should be only "-37": "SHA256".

File: Lib/Model/CoseAlgorithm.ts

Incorrect decoding for authenticator data

In the assertion service, authenticator data needs to be decoded from base64url format before being CBOR decoded.

node-webauthn/src/Lib/Service/AssertionService.ts

Line 96 in 5963174

await AuthenticatorData.decode(Buffer.from(response.authenticatorData));