Documentation
¶
Overview ¶
Package passkey runs the WebAuthn registration and sign-in ceremonies on top of go-webauthn.
The relying party ID is the host of the server's public URL and the only accepted origin is that URL, so a server reached by IP address (which WebAuthn forbids as an RP ID) has no passkeys; Enabled reports that.
A begun ceremony is kept in a short-lived cookie signed with the server's encryption key, so the finish can land on any server in the zone. Each challenge is accepted once per server: a finish remembers the challenge until it expires and refuses it after that.
The WebAuthn user handle is the user id's bytes, so a discoverable sign-in reads the user from the handle and then finds the credential among that user's passkeys.
Index ¶
- Constants
- Variables
- func BeginLogin(w http.ResponseWriter, r *http.Request) (*protocol.CredentialAssertion, error)
- func BeginRegistration(w http.ResponseWriter, r *http.Request, user *model.User) (*protocol.CredentialCreation, error)
- func Enabled() bool
- func FinishRegistration(w http.ResponseWriter, r *http.Request, user *model.User, credential []byte, ...) (*model.Passkey, error)
- func Origin() string
- func Remove(user *model.User, id string) (*model.Passkey, bool)
- type LoginResult
Constants ¶
const ChallengeTTL = 5 * time.Minute
ChallengeTTL is how long a begun ceremony stays valid.
const MaxPasskeys = 20
MaxPasskeys caps the passkeys one user may register.
Variables ¶
var ( // ErrDisabled means the server's URL cannot be a relying party (no host, or an IP address). ErrDisabled = errors.New("passkeys are not available on this server") // ErrChallenge means the ceremony is unknown, expired, already used or for someone else. ErrChallenge = errors.New("the passkey request expired, try again") // ErrVerify means the authenticator's response did not verify. ErrVerify = errors.New("the passkey could not be verified") // ErrUnknownCredential means no registered passkey matches the response. ErrUnknownCredential = errors.New("this passkey is not registered") // ErrCloneDetected means the sign counter did not increase: the credential may have been copied. ErrCloneDetected = errors.New("this passkey's counter went backwards, it may have been copied") // ErrInactive means the passkey's user is disabled or deleted. ErrInactive = errors.New("the account is not active") // ErrTooMany means the user already has MaxPasskeys passkeys. ErrTooMany = fmt.Errorf("an account can have at most %d passkeys", MaxPasskeys) )
Functions ¶
func BeginLogin ¶
func BeginLogin(w http.ResponseWriter, r *http.Request) (*protocol.CredentialAssertion, error)
BeginLogin starts a discoverable sign-in: the authenticator offers its passkeys for this server and the user picks one. User verification is required, so a passkey is a complete sign-in on its own.
func BeginRegistration ¶
func BeginRegistration(w http.ResponseWriter, r *http.Request, user *model.User) (*protocol.CredentialCreation, error)
BeginRegistration starts enrolling a passkey for user. The user's existing credentials are excluded so one authenticator isn't registered twice.
func Enabled ¶
func Enabled() bool
Enabled reports whether passkeys can be used with the server's URL.
func FinishRegistration ¶
func FinishRegistration(w http.ResponseWriter, r *http.Request, user *model.User, credential []byte, name string) (*model.Passkey, error)
FinishRegistration verifies the authenticator's attestation response (the JSON of PublicKeyCredential.toJSON()) and adds the passkey to user under name. The caller saves the user.
Types ¶
type LoginResult ¶
LoginResult is a verified passkey sign-in. The passkey's counters are updated on User, which the caller saves.
func FinishLogin ¶
func FinishLogin(w http.ResponseWriter, r *http.Request, credential []byte) (*LoginResult, error)
FinishLogin verifies an assertion (PublicKeyCredential.toJSON()) against the begun ceremony and checks the sign counter.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package virtualauth is a software WebAuthn authenticator for tests: it produces "none" attestations and ES256 assertions exactly as the specification lays them out, so ceremonies can be driven end to end without a browser.
|
Package virtualauth is a software WebAuthn authenticator for tests: it produces "none" attestations and ES256 assertions exactly as the specification lays them out, so ceremonies can be driven end to end without a browser. |