Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Device ¶
type Device struct {
SignCount uint32
// userVerified controls the UV flag — a fingerprint or PIN, as opposed to mere
// possession.
UserVerified bool
// UserHandle is what a DISCOVERABLE credential reports back: the account the
// authenticator stored beside the key. Empty for a second-factor assertion,
// where the server already knows whose login it is.
UserHandle []byte
// contains filtered or unexported fields
}
Package webauthntest provides a virtual authenticator: enough of a security key to exercise the real thing.
It lives in its own package rather than in a _test.go file because both the auth service tests and the HTTP pentests need it, and a harness duplicated in two places is a harness that drifts.
A virtual authenticator: enough of a security key to exercise the real thing.
WebAuthn cannot be tested by mocking the library — the library IS the check. So this builds what a real authenticator sends: a COSE ES256 public key, an authenticator data blob with the RP id hash and flags, a client data JSON bound to the challenge and origin, and an ECDSA signature over the two. Everything the server rejects, it rejects because one of those does not add up, which is what makes these tests worth having: they fail for the same reasons a real attack would.
It is deliberately dumb about state: the sign counter is a field the test moves by hand, because moving it backwards is exactly how a cloned key behaves.
func (*Device) Assert ¶
assert produces the JSON a browser posts after navigator.credentials.get.
The counter moves first, because a real authenticator increments it on every assertion — that movement is the whole clone-detection signal, and a harness that left it still would make an ordinary login look like a cloned key.
Source Files