bitwarden/browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser synced 2025-12-16 16:23:44 +00:00
Code Issues Releases Wiki Activity

[EC-598] feat: add general error handling for attestation

Browse Source
This commit is contained in:
Andreas Coroiu
2023-03-30 10:59:19 +02:00
parent b3d5ab4472
commit e7454501ea
2 changed files with 41 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libs/common/src/webauthn/services/fido2-authenticator.service.spec.ts
View File

@@ -724,6 +724,15 @@ describe("FidoAuthenticatorService", () => {
// Signatures are non-deterministic, and webcrypto can't verify DER signature format // Signatures are non-deterministic, and webcrypto can't verify DER signature format
// expect(result.signature).toMatchSnapshot(); // expect(result.signature).toMatchSnapshot();
}); });
/** Spec: If any error occurred while generating the assertion signature, return an error code equivalent to "UnknownError" and terminate the operation. */
it("should throw unkown error if creation fails", async () => {
cipherService.updateWithServer.mockRejectedValue(new Error("Internal error"));
const result = async () => await authenticator.getAssertion(params);
await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Unknown);
});
}); });
} }

60
libs/common/src/webauthn/services/fido2-authenticator.service.ts
View File

@@ -173,38 +173,42 @@ export class Fido2AuthenticatorService implements Fido2AuthenticatorServiceAbstr
throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed); throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed);
} }
const selectedCredentialId = try {
params.allowCredentialDescriptorList?.length > 0 const selectedCredentialId =
? selectedCipher.fido2Key.nonDiscoverableId params.allowCredentialDescriptorList?.length > 0
: selectedCipher.id; ? selectedCipher.fido2Key.nonDiscoverableId
: selectedCipher.id;
++selectedCipher.fido2Key.counter; ++selectedCipher.fido2Key.counter;
selectedCipher.localData.lastUsedDate = new Date().getTime(); selectedCipher.localData.lastUsedDate = new Date().getTime();
const encrypted = await this.cipherService.encrypt(selectedCipher); const encrypted = await this.cipherService.encrypt(selectedCipher);
await this.cipherService.updateWithServer(encrypted); await this.cipherService.updateWithServer(encrypted);
const authenticatorData = await generateAuthData({ const authenticatorData = await generateAuthData({
rpId: selectedCipher.fido2Key.rpId, rpId: selectedCipher.fido2Key.rpId,
credentialId: selectedCredentialId, credentialId: selectedCredentialId,
counter: selectedCipher.fido2Key.counter, counter: selectedCipher.fido2Key.counter,
userPresence: true, userPresence: true,
userVerification: false, userVerification: false,
}); });
const signature = await generateSignature({ const signature = await generateSignature({
authData: authenticatorData, authData: authenticatorData,
clientData: params.hash, clientData: params.hash,
privateKey: await getPrivateKeyFromCipher(selectedCipher), privateKey: await getPrivateKeyFromCipher(selectedCipher),
}); });
return { return {
authenticatorData, authenticatorData,
selectedCredential: { selectedCredential: {
id: selectedCredentialId, id: selectedCredentialId,
userHandle: Fido2Utils.stringToBuffer(selectedCipher.fido2Key.userHandle), userHandle: Fido2Utils.stringToBuffer(selectedCipher.fido2Key.userHandle),
}, },
signature, signature,
}; };
} catch {
throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.Unknown);
}
} }
private async vaultContainsCredentials( private async vaultContainsCredentials(