kai/web-terminal
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(relay-auth): close 5 pre-production security findings (F1–F5)

Browse Source 
F1 (HIGH): bind step-up freshness to the required method (stepUpMethod) so a
  login-time or weaker (TOTP) factor can no longer satisfy a passkey requirement.
F2 (HIGH): make the step-up gate host-driven and fail-closed on connect+reattach
  (deny when policy.required and the principal is missing/stale/wrong-method).
F3 (MED): bind the WebAuthn assertion to the stored credential (credentialId
  cross-check + forward publicKey/credentialId to the verifier).
F4 (LOW): make verifyDpopProof totally fail-safe (no unhandled throw), wrap the
  authz boundary into a clean audited 401, and validate cnfJkt format at issue.
F5 (LOW): return newSignCount from finishAuthentication so the caller can persist
  the advanced counter (WebAuthn clone detection).

All fixes ship regression tests. relay-auth: 122 tests green, tsc clean.
This commit is contained in:
Yaojia Wang
2026-07-02 16:41:18 +02:00
parent 1529d2c94c
commit a09c131539
15 changed files with 248 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
relay-auth/test/webauthn.test.ts
View File

@@ -21,14 +21,14 @@ const verifier: WebAuthnVerifier = {
signCount: 0,
transports: ['internal'],
}),
verifyAuthentication: async (_r, _c, _rp, _o, stored) => ({ verified: true, newSignCount: stored + 1 }),
verifyAuthentication: async (_r, _c, _rp, _o, _pk, _cid, stored) => ({ verified: true, newSignCount: stored + 1 }),
}
function regResp(over: Partial<RegistrationResponse> = {}): RegistrationResponse {
return { clientChallenge: 'chal', origin: ORIGIN, rpId: RP_ID, ...over }
}
function authResp(over: Partial<AuthenticationResponse> = {}): AuthenticationResponse {
return { clientChallenge: 'chal', origin: ORIGIN, rpId: RP_ID, ...over }
return { clientChallenge: 'chal', origin: ORIGIN, rpId: RP_ID, credentialId: 'cred-1', ...over }
}
const cred: WebAuthnCredential = {
credentialId: 'cred-1',
@@ -68,16 +68,32 @@ describe('WebAuthn / Passkey (T5, primary)', () => {
it('happy path auth yields a principal with amr:[passkey]', async () => {
const startOpts = await startAuthentication('acct-A', RP_ID)
expect(startOpts.rpId).toBe(RP_ID)
const p = await finishAuthentication(cred, authResp(), 'chal', RP_ID, ORIGIN, verifier, NOW)
const { principal: p } = await finishAuthentication(cred, authResp(), 'chal', RP_ID, ORIGIN, verifier, NOW)
expect(p.accountId).toBe('acct-A')
expect(p.amr).toEqual(['passkey'])
expect(p.authAt).toBe(NOW)
})
it('F3: rejects an assertion whose credentialId does not match the stored credential', async () => {
const forgiving: WebAuthnVerifier = {
...verifier,
verifyAuthentication: async (_r, _c, _rp, _o, _pk, _cid, stored) => ({ verified: true, newSignCount: stored + 1 }),
}
await expect(
finishAuthentication(cred, authResp({ credentialId: 'other-cred' }), 'chal', RP_ID, ORIGIN, forgiving, NOW),
).rejects.toThrow('credential id mismatch')
})
it('F5: returns the verifier-advanced newSignCount so the caller can persist it', async () => {
const { principal: p, newSignCount } = await finishAuthentication(cred, authResp(), 'chal', RP_ID, ORIGIN, verifier, NOW)
expect(p.accountId).toBe('acct-A')
expect(newSignCount).toBe(cred.signCount + 1)
})
it('rejects a signCount regression (cloned authenticator signal)', async () => {
const regressing: WebAuthnVerifier = {
...verifier,
verifyAuthentication: async () => ({ verified: true, newSignCount: 3 }), // < stored 5
verifyAuthentication: async () => ({ verified: true, newSignCount: 3 }), // < stored 5 (adapts to {principal,newSignCount} return)
}
await expect(
finishAuthentication(cred, authResp(), 'chal', RP_ID, ORIGIN, regressing, NOW),