⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 283515 in webkit


Ignore:
Timestamp:
Oct 4, 2021, 2:47:41 PM (5 years ago)
Author:
commit-queue@webkit.org
Message:

[WebAuthn] Prefer internal user verification if available over pin entry.
​https://bugs.webkit.org/show_bug.cgi?id=213903
<rdar://problem/65359269>

Patch by John Pascoe <J Pascoe> on 2021-10-04
Reviewed by Brent Fulgham.

Source/WebCore:

This adds an option to mock internal user verification in tests.

  • testing/MockWebAuthenticationConfiguration.h:

(WebCore::MockWebAuthenticationConfiguration::HidConfiguration::encode const):
(WebCore::MockWebAuthenticationConfiguration::HidConfiguration::decode):

  • testing/MockWebAuthenticationConfiguration.idl:

Source/WebKit:

  • UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:

(WebKit::MockHidConnection::feedReports):

  • UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:

(WebKit::CtapAuthenticator::makeCredential):
(WebKit::CtapAuthenticator::getAssertion):
(WebKit::fido::toStatus): Deleted.
(WebKit::fido::isPinError): Deleted.

Tools:

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:

(TestWebKitAPI::TEST):

  • TestWebKitAPI/Tests/WebKitCocoa/web-authentication-get-assertion-hid-internal-uv.html: Added.
  • TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-hid-internal-uv.html: Added.
Location:
trunk
Files:
2 added
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r283511 r283515  
     12021-10-04  John Pascoe  <j_pascoe@apple.com>
     2
     3        [WebAuthn] Prefer internal user verification if available over pin entry.
     4        https://bugs.webkit.org/show_bug.cgi?id=213903
     5        <rdar://problem/65359269>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        This adds an option to mock internal user verification in tests.
     10
     11        * testing/MockWebAuthenticationConfiguration.h:
     12        (WebCore::MockWebAuthenticationConfiguration::HidConfiguration::encode const):
     13        (WebCore::MockWebAuthenticationConfiguration::HidConfiguration::decode):
     14        * testing/MockWebAuthenticationConfiguration.idl:
     15
    1162021-10-04  Sam Weinig  <weinig@apple.com>
    217

  • trunk/Source/WebCore/testing/MockWebAuthenticationConfiguration.h

    r278253 r283515  
    9393        bool expectCancel { false };
    9494        bool supportClientPin { false };
     95        bool supportInternalUV { false };
    9596
    9697        template<class Encoder> void encode(Encoder&) const;
    … …  
    170171void MockWebAuthenticationConfiguration::HidConfiguration::encode(Encoder& encoder) const
    171172{
    172     encoder << payloadBase64 << stage << subStage << error << isU2f << keepAlive << fastDataArrival << continueAfterErrorData << canDowngrade << expectCancel << supportClientPin;
     173    encoder << payloadBase64 << stage << subStage << error << isU2f << keepAlive << fastDataArrival << continueAfterErrorData << canDowngrade << expectCancel << supportClientPin << supportInternalUV;
    173174}
    174175
    … …  
    198199        return std::nullopt;
    199200    if (!decoder.decode(result.supportClientPin))
     201        return std::nullopt;
     202    if (!decoder.decode(result.supportInternalUV))
    200203        return std::nullopt;
    201204    return result;

  • trunk/Source/WebCore/testing/MockWebAuthenticationConfiguration.idl

    r276180 r283515  
    103103    boolean expectCancel = false;
    104104    boolean supportClientPin = false;
     105    boolean supportInternalUV = false;
    105106};
    106107

  • trunk/Source/WebKit/ChangeLog

    r283514 r283515  
     12021-10-04  John Pascoe  <j_pascoe@apple.com>
     2
     3        [WebAuthn] Prefer internal user verification if available over pin entry.
     4        https://bugs.webkit.org/show_bug.cgi?id=213903
     5        <rdar://problem/65359269>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        * UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:
     10        (WebKit::MockHidConnection::feedReports):
     11        * UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:
     12        (WebKit::CtapAuthenticator::makeCredential):
     13        (WebKit::CtapAuthenticator::getAssertion):
     14        (WebKit::fido::toStatus): Deleted.
     15        (WebKit::fido::isPinError): Deleted.
     16
    1172021-10-04  John Pascoe  <j_pascoe@apple.com>
    218

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp

    r278253 r283515  
    229229        if (m_configuration.hid->canDowngrade)
    230230            infoData = encodeAsCBOR(AuthenticatorGetInfoResponse({ ProtocolVersion::kCtap, ProtocolVersion::kU2f }, Vector<uint8_t>(aaguidLength, 0u)));
    231         else if (m_configuration.hid->supportClientPin) {
     231        else {
    232232            AuthenticatorGetInfoResponse infoResponse({ ProtocolVersion::kCtap }, Vector<uint8_t>(aaguidLength, 0u));
    233             infoResponse.setPinProtocols({ pin::kProtocolVersion });
    234233            AuthenticatorSupportedOptions options;
    235             options.setClientPinAvailability(AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet);
     234            if (m_configuration.hid->supportClientPin) {
     235                infoResponse.setPinProtocols({ pin::kProtocolVersion });
     236                options.setClientPinAvailability(AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet);
     237            }
     238            if (m_configuration.hid->supportInternalUV)
     239                options.setUserVerificationAvailability(AuthenticatorSupportedOptions::UserVerificationAvailability::kSupportedAndConfigured);
    236240            infoResponse.setOptions(WTFMove(options));
    237241            infoData = encodeAsCBOR(infoResponse);
    238         } else
    239             infoData = encodeAsCBOR(AuthenticatorGetInfoResponse({ ProtocolVersion::kCtap }, Vector<uint8_t>(aaguidLength, 0u)));
     242        }
    240243        infoData.insert(0, static_cast<uint8_t>(CtapDeviceResponseCode::kSuccess)); // Prepend status code.
    241244        if (stagesMatch() && m_configuration.hid->error == Mock::HidError::WrongChannelId)

  • trunk/Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp

    r278358 r283515  
    4848using namespace fido;
    4949
     50using UVAvailability = AuthenticatorSupportedOptions::UserVerificationAvailability;
     51
    5052namespace {
    5153WebAuthenticationStatus toStatus(const CtapDeviceResponseCode& error)
    … …  
    9395    Vector<uint8_t> cborCmd;
    9496    auto& options = WTF::get<PublicKeyCredentialCreationOptions>(requestData().options);
    95     if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet)
    96         cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability(), PinParameters { pin::kProtocolVersion, m_pinAuth });
     97    auto internalUVAvailability = m_info.options().userVerificationAvailability();
     98    // If UV is required, then either built-in uv or a pin will work.
     99    if (internalUVAvailability == UVAvailability::kSupportedAndConfigured && (!options.authenticatorSelection || options.authenticatorSelection->userVerification != UserVerificationRequirement::Discouraged))
     100        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, internalUVAvailability);
     101    else if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet)
     102        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, internalUVAvailability, PinParameters { pin::kProtocolVersion, m_pinAuth });
    97103    else
    98         cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability());
     104        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, internalUVAvailability);
    99105    driver().transact(WTFMove(cborCmd), [weakThis = makeWeakPtr(*this)](Vector<uint8_t>&& data) {
    100106        ASSERT(RunLoop::isMain());
    … …  
    134140    Vector<uint8_t> cborCmd;
    135141    auto& options = WTF::get<PublicKeyCredentialRequestOptions>(requestData().options);
    136     if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet && options.userVerification != UserVerificationRequirement::Discouraged)
    137         cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability(), PinParameters { pin::kProtocolVersion, m_pinAuth });
     142    auto internalUVAvailability = m_info.options().userVerificationAvailability();
     143    // If UV is required, then either built-in uv or a pin will work.
     144    if (internalUVAvailability == UVAvailability::kSupportedAndConfigured && options.userVerification != UserVerificationRequirement::Discouraged)
     145        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, internalUVAvailability);
     146    else if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet && options.userVerification != UserVerificationRequirement::Discouraged)
     147        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, internalUVAvailability, PinParameters { pin::kProtocolVersion, m_pinAuth });
    138148    else
    139         cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability());
     149        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, internalUVAvailability);
    140150    driver().transact(WTFMove(cborCmd), [weakThis = makeWeakPtr(*this)](Vector<uint8_t>&& data) {
    141151        ASSERT(RunLoop::isMain());

  • trunk/Tools/ChangeLog

    r283514 r283515  
     12021-10-04  John Pascoe  <j_pascoe@apple.com>
     2
     3        [WebAuthn] Prefer internal user verification if available over pin entry.
     4        https://bugs.webkit.org/show_bug.cgi?id=213903
     5        <rdar://problem/65359269>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
     10        * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
     11        (TestWebKitAPI::TEST):
     12        * TestWebKitAPI/Tests/WebKitCocoa/web-authentication-get-assertion-hid-internal-uv.html: Added.
     13        * TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-hid-internal-uv.html: Added.
     14
    1152021-10-04  John Pascoe  <j_pascoe@apple.com>
    216

  • trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

    r283476 r283515  
    396396                524BBCA119E30C77002F1AF1 /* test.mp4 in Copy Resources */ = {isa = PBXBuildFile; fileRef = 524BBCA019E30C63002F1AF1 /* test.mp4 */; };
    397397                52B8CF9815868D9100281053 /* SetDocumentURI.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 52B8CF9415868CF000281053 /* SetDocumentURI.html */; };
     398                52C8C1382706437C00BDF3B7 /* web-authentication-make-credential-hid-internal-uv.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 52C8C1372706437C00BDF3B7 /* web-authentication-make-credential-hid-internal-uv.html */; };
     399                52C8C13A2706439000BDF3B7 /* web-authentication-get-assertion-hid-internal-uv.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 52C8C1392706439000BDF3B7 /* web-authentication-get-assertion-hid-internal-uv.html */; };
    398400                52D5D6C021B9F1B30046ABA6 /* RenderingProgress.mm in Sources */ = {isa = PBXBuildFile; fileRef = 52D5D6BD21B9F1B20046ABA6 /* RenderingProgress.mm */; };
    399401                52D673EE1AFB127300FA19FE /* WKPageCopySessionStateWithFiltering.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52D673EC1AFB126800FA19FE /* WKPageCopySessionStateWithFiltering.cpp */; };
    … …  
    17531755                                CD577799211CE0E4001B371E /* web-audio-only.html in Copy Resources */,
    17541756                                57663DF32357E48900E85E09 /* web-authentication-get-assertion-hid-cancel.html in Copy Resources */,
     1757                                52C8C13A2706439000BDF3B7 /* web-authentication-get-assertion-hid-internal-uv.html in Copy Resources */,
    17551758                                579F1C0123C93AF500C7D4B4 /* web-authentication-get-assertion-hid-multiple-accounts.html in Copy Resources */,
    17561759                                577454D02359B378008E1ED7 /* web-authentication-get-assertion-hid-no-credentials.html in Copy Resources */,
    … …  
    17661769                                577454D22359BB01008E1ED7 /* web-authentication-get-assertion-u2f-no-credentials.html in Copy Resources */,
    17671770                                57C624502346C21E00383FE7 /* web-authentication-get-assertion.html in Copy Resources */,
     1771                                52C8C1382706437C00BDF3B7 /* web-authentication-make-credential-hid-internal-uv.html in Copy Resources */,
    17681772                                578DA44823ECD09B00246010 /* web-authentication-make-credential-hid-pin-auth-blocked-error.html in Copy Resources */,
    17691773                                570D26F423C3CA6A00D5CF67 /* web-authentication-make-credential-hid-pin-get-key-agreement-error.html in Copy Resources */,
    … …  
    22582262                52B8CF9415868CF000281053 /* SetDocumentURI.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = SetDocumentURI.html; sourceTree = "<group>"; };
    22592263                52B8CF9515868CF000281053 /* SetDocumentURI.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SetDocumentURI.mm; sourceTree = "<group>"; };
     2264                52C8C1372706437C00BDF3B7 /* web-authentication-make-credential-hid-internal-uv.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; name = "web-authentication-make-credential-hid-internal-uv.html"; path = "Tests/WebKitCocoa/web-authentication-make-credential-hid-internal-uv.html"; sourceTree = "<group>"; };
     2265                52C8C1392706439000BDF3B7 /* web-authentication-get-assertion-hid-internal-uv.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; name = "web-authentication-get-assertion-hid-internal-uv.html"; path = "Tests/WebKitCocoa/web-authentication-get-assertion-hid-internal-uv.html"; sourceTree = "<group>"; };
    22602266                52CB47401448FB9300873995 /* LoadAlternateHTMLStringWithNonDirectoryURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoadAlternateHTMLStringWithNonDirectoryURL.cpp; sourceTree = "<group>"; };
    22612267                52D5D6BD21B9F1B20046ABA6 /* RenderingProgress.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RenderingProgress.mm; sourceTree = "<group>"; };
    … …  
    32553261                        isa = PBXGroup;
    32563262                        children = (
     3263                                52C8C1392706439000BDF3B7 /* web-authentication-get-assertion-hid-internal-uv.html */,
     3264                                52C8C1372706437C00BDF3B7 /* web-authentication-make-credential-hid-internal-uv.html */,
    32573265                                49AEEF682407276F00C87E4C /* Info.plist */,
    32583266                                5C9D922622D7DD7B008E9266 /* Derived Sources */,

  • trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm

    r283514 r283515  
    11241124}
    11251125
     1126TEST(WebAuthenticationPanel, MakeCredentialInternalUV)
     1127{
     1128    reset();
     1129    RetainPtr<NSURL> testURL = [[NSBundle mainBundle] URLForResource:@"web-authentication-make-credential-hid-internal-uv" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"];
     1130
     1131    auto *configuration = [WKWebViewConfiguration _test_configurationWithTestPlugInClassName:@"WebProcessPlugInWithInternals" configureJSCForTesting:YES];
     1132    [[configuration preferences] _setEnabled:YES forExperimentalFeature:webAuthenticationExperimentalFeature()];
     1133    [[configuration preferences] _setEnabled:NO forExperimentalFeature:webAuthenticationModernExperimentalFeature()];
     1134
     1135    auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSZeroRect configuration:configuration]);
     1136    auto delegate = adoptNS([[TestWebAuthenticationPanelUIDelegate alloc] init]);
     1137    [webView setUIDelegate:delegate.get()];
     1138    [webView focus];
     1139
     1140    [webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
     1141    [webView waitForMessage:@"Succeeded!"];
     1142}
     1143
    11261144TEST(WebAuthenticationPanel, MakeCredentialPin)
    11271145{
    … …  
    11991217
    12001218    webAuthenticationPanelPin = "1234";
     1219    [webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
     1220    [webView waitForMessage:@"Succeeded!"];
     1221}
     1222
     1223TEST(WebAuthenticationPanel, GetAssertionInternalUV)
     1224{
     1225    reset();
     1226    RetainPtr<NSURL> testURL = [[NSBundle mainBundle] URLForResource:@"web-authentication-get-assertion-hid-internal-uv" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"];
     1227
     1228    auto *configuration = [WKWebViewConfiguration _test_configurationWithTestPlugInClassName:@"WebProcessPlugInWithInternals" configureJSCForTesting:YES];
     1229    [[configuration preferences] _setEnabled:YES forExperimentalFeature:webAuthenticationExperimentalFeature()];
     1230    [[configuration preferences] _setEnabled:NO forExperimentalFeature:webAuthenticationModernExperimentalFeature()];
     1231
     1232    auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSZeroRect configuration:configuration]);
     1233    auto delegate = adoptNS([[TestWebAuthenticationPanelUIDelegate alloc] init]);
     1234    [webView setUIDelegate:delegate.get()];
     1235    [webView focus];
     1236
    12011237    [webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
    12021238    [webView waitForMessage:@"Succeeded!"];
Note: See TracChangeset for help on using the changeset viewer.