c# rewrite
This commit is contained in:
parent
712e3294ac
commit
82bc13de67
GPG key ID:
CABF2F86EF7884F9
11 changed files with 793 additions and 313 deletions
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
bin/
|
||||
obj/
|
||||
credentials.db
|
||||
23
Dockerfile
23
Dockerfile
|
|
@ -1,11 +1,12 @@
|
|||
from alpine:latest
|
||||
run apk update && apk upgrade
|
||||
run apk add python3 py3-virtualenv
|
||||
run adduser -D -u 1000 webauthn
|
||||
copy . /opt/app
|
||||
run chown -R webauthn:webauthn /opt/app
|
||||
user webauthn
|
||||
workdir /opt/app
|
||||
run virtualenv venv
|
||||
run . venv/bin/activate && pip install -r requirements.txt
|
||||
cmd ["./run.sh"]
|
||||
from mcr.microsoft.com/dotnet/sdk:7.0 as build-env
|
||||
|
||||
workdir /App
|
||||
copy ./src/ ./
|
||||
run dotnet restore
|
||||
run dotnet publish -c Release -o out
|
||||
|
||||
from mcr.microsoft.com/dotnet/aspnet:7.0
|
||||
|
||||
workdir /App
|
||||
copy --from=build-env /App/out .
|
||||
entrypoint ["dotnet", "webauthn-proxy.dll"]
|
||||
|
|
|
|||
296
main.py
296
main.py
|
|
@ -1,296 +0,0 @@
|
|||
from json.decoder import JSONDecodeError
|
||||
import datetime
|
||||
import random
|
||||
import socketserver
|
||||
import http.server
|
||||
import http.cookies
|
||||
import json
|
||||
import base64
|
||||
import sys
|
||||
import os
|
||||
import time
|
||||
|
||||
from fido2.client import ClientData
|
||||
from fido2.webauthn import PublicKeyCredentialRpEntity
|
||||
from fido2.server import U2FFido2Server
|
||||
from fido2.ctap2 import AttestationObject, AttestedCredentialData, AuthenticatorData
|
||||
from fido2 import cbor
|
||||
|
||||
TOKEN_LIFETIME = 60 * 60 * 24 * 7
|
||||
PORT = 8000
|
||||
FORM = """
|
||||
<body>
|
||||
<script>
|
||||
|
||||
function atobarray(sBase64) {
|
||||
var sBinaryString = atob(sBase64), aBinaryView = new Uint8Array(sBinaryString.length);
|
||||
Array.prototype.forEach.call(aBinaryView, function (el, idx, arr) { arr[idx] = sBinaryString.charCodeAt(idx); });
|
||||
return aBinaryView;
|
||||
}
|
||||
|
||||
function barraytoa(arrayBuffer) {
|
||||
return btoa(String.fromCharCode(...new Uint8Array(arrayBuffer)));
|
||||
}
|
||||
|
||||
async function configure() {
|
||||
try {
|
||||
let data = await fetch('/auth/get_challenge_for_new_key', { method: 'POST' });
|
||||
let json = await data.json()
|
||||
json.publicKey.challenge = atobarray(json.publicKey.challenge)
|
||||
json.publicKey.user.id = atobarray(json.publicKey.user.id)
|
||||
let cred = await navigator.credentials.create(json)
|
||||
window.command.innerHTML = 'On your server, to save this key please run:<br /><pre>python main.py save-client ' + window.location.host + ' ' + barraytoa(cred.response.clientDataJSON) + ' ' + barraytoa(cred.response.attestationObject) + '</pre>'
|
||||
} catch (e) {
|
||||
console.log(e)
|
||||
}
|
||||
}
|
||||
|
||||
(async function init() {
|
||||
try {
|
||||
let data = await fetch('/auth/get_challenge_for_existing_key', { method: 'POST' });
|
||||
let json = await data.json()
|
||||
if (json.publicKey !== undefined) {
|
||||
json.publicKey.challenge = atobarray(json.publicKey.challenge)
|
||||
for (let i = 0; i < json.publicKey.allowCredentials.length; i++) {
|
||||
json.publicKey.allowCredentials[i].id = atobarray(json.publicKey.allowCredentials[i].id)
|
||||
}
|
||||
try {
|
||||
var result = await navigator.credentials.get(json)
|
||||
} catch(e) {
|
||||
console.log('unknown key')
|
||||
await configure()
|
||||
return
|
||||
}
|
||||
await fetch('/auth/complete_challenge_for_existing_key', { method: 'POST', body: JSON.stringify({
|
||||
id: barraytoa(result.rawId),
|
||||
authenticatorData: barraytoa(result.response.authenticatorData),
|
||||
clientDataJSON: barraytoa(result.response.clientDataJSON),
|
||||
signature: barraytoa(result.response.signature)
|
||||
}), headers:{ 'Content-Type': 'application/json' }})
|
||||
let params = await new URLSearchParams(window.location.search)
|
||||
if (params.has('target')) {
|
||||
window.location.href = params.get('target')
|
||||
} else {
|
||||
window.location.href = "/"
|
||||
}
|
||||
}
|
||||
if (json.error == 'not_configured') {
|
||||
await configure()
|
||||
}
|
||||
} catch(e) {
|
||||
console.log(e)
|
||||
}
|
||||
})()
|
||||
</script>
|
||||
<div id="command"></div>
|
||||
</body>
|
||||
"""
|
||||
|
||||
class TokenManager(object):
|
||||
"""Who needs a database when you can just store everything in memory?"""
|
||||
|
||||
def __init__(self):
|
||||
self.tokens = {}
|
||||
self.random = random.SystemRandom()
|
||||
|
||||
def generate(self):
|
||||
t = '%064x' % self.random.getrandbits(8*32)
|
||||
self.tokens[t] = time.time()
|
||||
return t
|
||||
|
||||
def is_valid(self, t):
|
||||
try:
|
||||
return time.time() - self.tokens.get(t, 0) < TOKEN_LIFETIME
|
||||
except Exception:
|
||||
return False
|
||||
|
||||
def invalidate(self, t):
|
||||
if t in self.tokens:
|
||||
del self.tokens[t]
|
||||
|
||||
CHALLENGE = {}
|
||||
TOKEN_MANAGER = TokenManager()
|
||||
|
||||
class AuthHandler(http.server.BaseHTTPRequestHandler):
|
||||
def do_GET(self):
|
||||
if self.path == '/auth/check':
|
||||
cookie = http.cookies.SimpleCookie(self.headers.get('Cookie'))
|
||||
if '__Secure-Token' in cookie and TOKEN_MANAGER.is_valid(cookie['__Secure-Token'].value):
|
||||
self.send_response(200)
|
||||
self.end_headers()
|
||||
return
|
||||
|
||||
self.send_response(401)
|
||||
self.end_headers()
|
||||
return
|
||||
|
||||
if self.path[:11] == "/auth/login":
|
||||
self.send_response(200)
|
||||
self.send_header('Content-type', 'text/html')
|
||||
self.end_headers()
|
||||
self.wfile.write(bytes(FORM, 'UTF-8'))
|
||||
return
|
||||
|
||||
if self.path == '/auth/logout':
|
||||
cookie = http.cookies.SimpleCookie(self.headers.get('Cookie'))
|
||||
if '__Secure-Token' in cookie:
|
||||
TOKEN_MANAGER.invalidate(cookie['__Secure-Token'].value)
|
||||
|
||||
# This just replaces the token with garbage
|
||||
self.send_response(302)
|
||||
cookie = http.cookies.SimpleCookie()
|
||||
cookie["__Secure-Token"] = ''
|
||||
cookie["__Secure-Token"]["path"] = '/'
|
||||
cookie["__Secure-Token"]["secure"] = True
|
||||
cookie["__Secure-Token"]["max-age"] = 0 # remove the cookie ASAP
|
||||
self.send_header('Set-Cookie', cookie.output(header=''))
|
||||
self.send_header('Location', '/')
|
||||
self.end_headers()
|
||||
|
||||
self.send_response(404)
|
||||
self.end_headers()
|
||||
|
||||
def do_POST(self):
|
||||
origin = self.headers.get('Origin')
|
||||
host = origin[len('https://'):]
|
||||
|
||||
rp = PublicKeyCredentialRpEntity(host, 'NGINX Auth Server')
|
||||
server = U2FFido2Server(origin, rp)
|
||||
|
||||
if self.path == "/auth/get_challenge_for_new_key":
|
||||
# check whether credentials file is locked (can't be written)
|
||||
if os.access('.credentials', os.F_OK) and not os.access('.credentials', os.W_OK):
|
||||
self.send_response(403)
|
||||
self.end_headers()
|
||||
return
|
||||
|
||||
registration_data, state = server.register_begin({ 'id': b'default', 'name': "Default user", 'displayName': "Default user" })
|
||||
registration_data["publicKey"]["challenge"] = str(base64.b64encode(registration_data["publicKey"]["challenge"]), 'utf-8')
|
||||
registration_data["publicKey"]["user"]["id"] = str(base64.b64encode(registration_data["publicKey"]["user"]["id"]), 'utf-8')
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header('Content-type', 'application/json')
|
||||
self.end_headers()
|
||||
# Save this challenge to a file so you can kill the host to add the client via CLI
|
||||
with open('data/lastchallenge', 'w') as f:
|
||||
f.write(json.dumps(state))
|
||||
self.wfile.write(bytes(json.dumps(registration_data), 'UTF-8'))
|
||||
return
|
||||
|
||||
creds = []
|
||||
try:
|
||||
with open('data/credentials', 'r', encoding='utf8') as f:
|
||||
for cred_b64 in json.load(f):
|
||||
cred, _ = AttestedCredentialData.unpack_from(base64.b64decode(cred_b64))
|
||||
creds.append(cred)
|
||||
except:
|
||||
self.send_response(401)
|
||||
self.send_header('Content-type', 'application/json')
|
||||
self.end_headers()
|
||||
self.wfile.write(bytes(json.dumps({'error': 'not_configured'}), 'UTF-8'))
|
||||
return
|
||||
|
||||
if self.path == "/auth/get_challenge_for_existing_key":
|
||||
auth_data, state = server.authenticate_begin(creds)
|
||||
auth_data["publicKey"]["challenge"] = str(base64.b64encode(auth_data["publicKey"]["challenge"]), 'utf-8')
|
||||
for i in range(len(auth_data["publicKey"]["allowCredentials"])):
|
||||
auth_data["publicKey"]["allowCredentials"][i]["id"] = base64.b64encode(auth_data["publicKey"]["allowCredentials"][i]["id"]).decode('utf8')
|
||||
|
||||
CHALLENGE.update(state)
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header('Content-type', 'application/json')
|
||||
self.end_headers()
|
||||
self.wfile.write(bytes(json.dumps(auth_data), 'UTF-8'))
|
||||
|
||||
if self.path == "/auth/complete_challenge_for_existing_key":
|
||||
data = json.loads(self.rfile.read(int(self.headers.get('Content-Length'))))
|
||||
|
||||
credential_id = base64.b64decode(data['id'])
|
||||
client_data = ClientData(base64.b64decode(data['clientDataJSON']))
|
||||
auth_data = AuthenticatorData(base64.b64decode(data['authenticatorData']))
|
||||
signature = base64.b64decode(data['signature'])
|
||||
|
||||
server.authenticate_complete(
|
||||
CHALLENGE,
|
||||
creds,
|
||||
credential_id,
|
||||
client_data,
|
||||
auth_data,
|
||||
signature
|
||||
)
|
||||
|
||||
cookie = http.cookies.SimpleCookie()
|
||||
cookie["__Secure-Token"] = TOKEN_MANAGER.generate()
|
||||
cookie["__Secure-Token"]["path"] = "/"
|
||||
cookie["__Secure-Token"]["secure"] = True
|
||||
cookie["__Secure-Token"]["httponly"] = True
|
||||
cookie["__Secure-Token"]["samesite"] = 'None'
|
||||
cookie["__Secure-Token"]["domain"] = 'rdsm.ca'
|
||||
cookie["__Secure-Token"]["max-age"] = TOKEN_LIFETIME
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header('Set-Cookie', cookie.output(header=''))
|
||||
self.end_headers()
|
||||
self.wfile.write(bytes(json.dumps({'status': 'ok'}), 'UTF-8'))
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
def run_server():
|
||||
socketserver.TCPServer.allow_reuse_address = True
|
||||
httpd = socketserver.TCPServer(("", PORT), AuthHandler)
|
||||
try:
|
||||
httpd.serve_forever()
|
||||
finally:
|
||||
httpd.server_close()
|
||||
|
||||
if len(sys.argv) > 1 and sys.argv[1] == "save-client":
|
||||
host = sys.argv[2]
|
||||
client_data = ClientData(base64.b64decode(sys.argv[3]))
|
||||
attestation_object = AttestationObject(base64.b64decode(sys.argv[4]))
|
||||
|
||||
rp = PublicKeyCredentialRpEntity(host, 'NGINX Auth Server')
|
||||
server = U2FFido2Server('https://' + host, rp)
|
||||
|
||||
with open('data/lastchallenge') as f:
|
||||
auth_data = server.register_complete(json.loads(f.read()), client_data, attestation_object)
|
||||
cred = base64.b64encode(auth_data.credential_data).decode('utf8')
|
||||
with open('data/credentials', 'a+', encoding='utf8') as f:
|
||||
f.seek(0)
|
||||
try:
|
||||
creds = json.load(f)
|
||||
except JSONDecodeError:
|
||||
creds = []
|
||||
print("Created new credentials file")
|
||||
if cred not in creds:
|
||||
creds.append(cred)
|
||||
f.truncate(0)
|
||||
json.dump(creds, f)
|
||||
print("Credentials saved successfully")
|
||||
else:
|
||||
print("Credentials already in database")
|
||||
|
||||
elif len(sys.argv) == 2 and sys.argv[1] == '-d':
|
||||
# starts the server non-daemonized
|
||||
run_server()
|
||||
|
||||
else:
|
||||
from daemon import DaemonContext
|
||||
from sys import stdout, stderr, exit
|
||||
from lockfile import FileLock
|
||||
from signal import SIGTERM, SIGTSTP
|
||||
|
||||
def shutdown(signum, frame):
|
||||
exit(0)
|
||||
|
||||
with DaemonContext(
|
||||
chroot_directory=None,
|
||||
working_directory='/opt/app',
|
||||
stdout=stdout,
|
||||
stderr=stderr,
|
||||
pidfile=FileLock('/var/run/webauthn/webauthn.pid'),
|
||||
signal_map={
|
||||
SIGTERM: shutdown,
|
||||
SIGTSTP: shutdown
|
||||
}):
|
||||
run_server()
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
fido2==0.8.1
|
||||
python-daemon
|
||||
4
run.sh
4
run.sh
|
|
@ -1,4 +0,0 @@
|
|||
#!/bin/sh
|
||||
|
||||
. venv/bin/activate
|
||||
exec python main.py -d
|
||||
323
src/.editorconfig
Normal file
323
src/.editorconfig
Normal file
|
|
@ -0,0 +1,323 @@
|
|||
# EditorConfig is awesome: https://EditorConfig.org
|
||||
|
||||
# top-most EditorConfig file
|
||||
root = true
|
||||
|
||||
# Don't use tabs for indentation.
|
||||
[*]
|
||||
end_of_line = lf
|
||||
indent_style = space
|
||||
# (Please don't specify an indent_size here; that has too many unintended consequences.)
|
||||
|
||||
# Code files
|
||||
[*.{cs,csx,vb,vbx}]
|
||||
indent_size = 2
|
||||
insert_final_newline = true
|
||||
charset = utf-8-bom
|
||||
|
||||
# XML project files
|
||||
[*.{csproj,vbproj,vcxproj,vcxproj.filters,proj,projitems,shproj}]
|
||||
indent_size = 2
|
||||
|
||||
# XML config files
|
||||
[*.{props,targets,ruleset,config,nuspec,resx,vsixmanifest,vsct}]
|
||||
indent_size = 2
|
||||
|
||||
# JSON files
|
||||
[*.json]
|
||||
indent_size = 2
|
||||
|
||||
# Powershell files
|
||||
[*.ps1]
|
||||
indent_size = 2
|
||||
|
||||
# Shell script files
|
||||
[*.sh]
|
||||
indent_size = 2
|
||||
|
||||
# Dotnet code style settings:
|
||||
[*.{cs,vb}]
|
||||
|
||||
# IDE0055: Fix formatting
|
||||
dotnet_diagnostic.IDE0055.severity = warning
|
||||
|
||||
# CA1848: Use LoggerDelegates
|
||||
dotnet_diagnostic.CA1848.severity = none
|
||||
|
||||
# Sort using and Import directives with System.* appearing first
|
||||
dotnet_sort_system_directives_first = true
|
||||
dotnet_separate_import_directive_groups = false
|
||||
# Avoid "this." and "Me." if not necessary
|
||||
dotnet_style_qualification_for_field = false:refactoring
|
||||
dotnet_style_qualification_for_property = false:refactoring
|
||||
dotnet_style_qualification_for_method = false:refactoring
|
||||
dotnet_style_qualification_for_event = false:refactoring
|
||||
|
||||
# Use language keywords instead of framework type names for type references
|
||||
dotnet_style_predefined_type_for_locals_parameters_members = true:suggestion
|
||||
dotnet_style_predefined_type_for_member_access = true:suggestion
|
||||
|
||||
# Suggest more modern language features when available
|
||||
dotnet_style_object_initializer = true:suggestion
|
||||
dotnet_style_collection_initializer = true:suggestion
|
||||
dotnet_style_coalesce_expression = true:suggestion
|
||||
dotnet_style_null_propagation = true:suggestion
|
||||
dotnet_style_explicit_tuple_names = true:suggestion
|
||||
|
||||
# Whitespace options
|
||||
dotnet_style_allow_multiple_blank_lines_experimental = false
|
||||
|
||||
# Non-private static fields are PascalCase
|
||||
dotnet_naming_rule.non_private_static_fields_should_be_pascal_case.severity = suggestion
|
||||
dotnet_naming_rule.non_private_static_fields_should_be_pascal_case.symbols = non_private_static_fields
|
||||
dotnet_naming_rule.non_private_static_fields_should_be_pascal_case.style = non_private_static_field_style
|
||||
|
||||
dotnet_naming_symbols.non_private_static_fields.applicable_kinds = field
|
||||
dotnet_naming_symbols.non_private_static_fields.applicable_accessibilities = public, protected, internal, protected_internal, private_protected
|
||||
dotnet_naming_symbols.non_private_static_fields.required_modifiers = static
|
||||
|
||||
dotnet_naming_style.non_private_static_field_style.capitalization = pascal_case
|
||||
|
||||
# Non-private readonly fields are PascalCase
|
||||
dotnet_naming_rule.non_private_readonly_fields_should_be_pascal_case.severity = suggestion
|
||||
dotnet_naming_rule.non_private_readonly_fields_should_be_pascal_case.symbols = non_private_readonly_fields
|
||||
dotnet_naming_rule.non_private_readonly_fields_should_be_pascal_case.style = non_private_readonly_field_style
|
||||
|
||||
dotnet_naming_symbols.non_private_readonly_fields.applicable_kinds = field
|
||||
dotnet_naming_symbols.non_private_readonly_fields.applicable_accessibilities = public, protected, internal, protected_internal, private_protected
|
||||
dotnet_naming_symbols.non_private_readonly_fields.required_modifiers = readonly
|
||||
|
||||
dotnet_naming_style.non_private_readonly_field_style.capitalization = pascal_case
|
||||
|
||||
# Constants are PascalCase
|
||||
dotnet_naming_rule.constants_should_be_pascal_case.severity = suggestion
|
||||
dotnet_naming_rule.constants_should_be_pascal_case.symbols = constants
|
||||
dotnet_naming_rule.constants_should_be_pascal_case.style = constant_style
|
||||
|
||||
dotnet_naming_symbols.constants.applicable_kinds = field, local
|
||||
dotnet_naming_symbols.constants.required_modifiers = const
|
||||
|
||||
dotnet_naming_style.constant_style.capitalization = pascal_case
|
||||
|
||||
# Static fields are camelCase and start with s_
|
||||
dotnet_naming_rule.static_fields_should_be_camel_case.severity = suggestion
|
||||
dotnet_naming_rule.static_fields_should_be_camel_case.symbols = static_fields
|
||||
dotnet_naming_rule.static_fields_should_be_camel_case.style = static_field_style
|
||||
|
||||
dotnet_naming_symbols.static_fields.applicable_kinds = field
|
||||
dotnet_naming_symbols.static_fields.required_modifiers = static
|
||||
|
||||
dotnet_naming_style.static_field_style.capitalization = camel_case
|
||||
dotnet_naming_style.static_field_style.required_prefix = s_
|
||||
|
||||
# Instance fields are camelCase and start with _
|
||||
dotnet_naming_rule.instance_fields_should_be_camel_case.severity = suggestion
|
||||
dotnet_naming_rule.instance_fields_should_be_camel_case.symbols = instance_fields
|
||||
dotnet_naming_rule.instance_fields_should_be_camel_case.style = instance_field_style
|
||||
|
||||
dotnet_naming_symbols.instance_fields.applicable_kinds = field
|
||||
|
||||
dotnet_naming_style.instance_field_style.capitalization = camel_case
|
||||
dotnet_naming_style.instance_field_style.required_prefix = _
|
||||
|
||||
# Locals and parameters are camelCase
|
||||
dotnet_naming_rule.locals_should_be_camel_case.severity = suggestion
|
||||
dotnet_naming_rule.locals_should_be_camel_case.symbols = locals_and_parameters
|
||||
dotnet_naming_rule.locals_should_be_camel_case.style = camel_case_style
|
||||
|
||||
dotnet_naming_symbols.locals_and_parameters.applicable_kinds = parameter, local
|
||||
|
||||
dotnet_naming_style.camel_case_style.capitalization = camel_case
|
||||
|
||||
# Local functions are PascalCase
|
||||
dotnet_naming_rule.local_functions_should_be_pascal_case.severity = suggestion
|
||||
dotnet_naming_rule.local_functions_should_be_pascal_case.symbols = local_functions
|
||||
dotnet_naming_rule.local_functions_should_be_pascal_case.style = local_function_style
|
||||
|
||||
dotnet_naming_symbols.local_functions.applicable_kinds = local_function
|
||||
|
||||
dotnet_naming_style.local_function_style.capitalization = pascal_case
|
||||
|
||||
# By default, name items with PascalCase
|
||||
dotnet_naming_rule.members_should_be_pascal_case.severity = suggestion
|
||||
dotnet_naming_rule.members_should_be_pascal_case.symbols = all_members
|
||||
dotnet_naming_rule.members_should_be_pascal_case.style = pascal_case_style
|
||||
|
||||
dotnet_naming_symbols.all_members.applicable_kinds = *
|
||||
|
||||
dotnet_naming_style.pascal_case_style.capitalization = pascal_case
|
||||
|
||||
# error RS2008: Enable analyzer release tracking for the analyzer project containing rule '{0}'
|
||||
dotnet_diagnostic.RS2008.severity = none
|
||||
|
||||
# IDE0073: File header
|
||||
dotnet_diagnostic.IDE0073.severity = none
|
||||
file_header_template =
|
||||
|
||||
# IDE0035: Remove unreachable code
|
||||
dotnet_diagnostic.IDE0035.severity = warning
|
||||
|
||||
# IDE0036: Order modifiers
|
||||
dotnet_diagnostic.IDE0036.severity = warning
|
||||
|
||||
# IDE0043: Format string contains invalid placeholder
|
||||
dotnet_diagnostic.IDE0043.severity = warning
|
||||
|
||||
# IDE0044: Make field readonly
|
||||
dotnet_diagnostic.IDE0044.severity = warning
|
||||
|
||||
# RS0016: Only enable if API files are present
|
||||
dotnet_public_api_analyzer.require_api_files = true
|
||||
|
||||
# CSharp code style settings:
|
||||
[*.cs]
|
||||
|
||||
# enforce file scoped namespaces
|
||||
csharp_style_namespace_declarations = file_scoped:warning
|
||||
|
||||
# Newline settings
|
||||
csharp_new_line_before_open_brace = none
|
||||
csharp_new_line_before_else = false
|
||||
csharp_new_line_before_catch = false
|
||||
csharp_new_line_before_finally = false
|
||||
csharp_new_line_before_members_in_object_initializers = true
|
||||
csharp_new_line_before_members_in_anonymous_types = true
|
||||
csharp_new_line_between_query_expression_clauses = true
|
||||
|
||||
# Indentation preferences
|
||||
csharp_indent_block_contents = true
|
||||
csharp_indent_braces = false
|
||||
csharp_indent_case_contents = true
|
||||
csharp_indent_case_contents_when_block = false
|
||||
csharp_indent_switch_labels = true
|
||||
csharp_indent_labels = flush_left
|
||||
|
||||
# Whitespace options
|
||||
csharp_style_allow_embedded_statements_on_same_line_experimental = true
|
||||
csharp_style_allow_blank_lines_between_consecutive_braces_experimental = false
|
||||
csharp_style_allow_blank_line_after_colon_in_constructor_initializer_experimental = false
|
||||
|
||||
# Prefer "var" everywhere
|
||||
csharp_style_var_for_built_in_types = true:suggestion
|
||||
csharp_style_var_when_type_is_apparent = true:suggestion
|
||||
csharp_style_var_elsewhere = true:suggestion
|
||||
|
||||
# Prefer method-like constructs to have a block body
|
||||
csharp_style_expression_bodied_methods = false:none
|
||||
csharp_style_expression_bodied_constructors = false:none
|
||||
csharp_style_expression_bodied_operators = false:none
|
||||
|
||||
# Prefer property-like constructs to have an expression-body
|
||||
csharp_style_expression_bodied_properties = true:none
|
||||
csharp_style_expression_bodied_indexers = true:none
|
||||
csharp_style_expression_bodied_accessors = true:none
|
||||
|
||||
# Suggest more modern language features when available
|
||||
csharp_style_pattern_matching_over_is_with_cast_check = true:suggestion
|
||||
csharp_style_pattern_matching_over_as_with_null_check = true:suggestion
|
||||
csharp_style_inlined_variable_declaration = true:suggestion
|
||||
csharp_style_throw_expression = true:suggestion
|
||||
csharp_style_conditional_delegate_call = true:suggestion
|
||||
|
||||
# Space preferences
|
||||
csharp_space_after_cast = false
|
||||
csharp_space_after_colon_in_inheritance_clause = true
|
||||
csharp_space_after_comma = true
|
||||
csharp_space_after_dot = false
|
||||
csharp_space_after_keywords_in_control_flow_statements = true
|
||||
csharp_space_after_semicolon_in_for_statement = true
|
||||
csharp_space_around_binary_operators = before_and_after
|
||||
csharp_space_around_declaration_statements = do_not_ignore
|
||||
csharp_space_before_colon_in_inheritance_clause = true
|
||||
csharp_space_before_comma = false
|
||||
csharp_space_before_dot = false
|
||||
csharp_space_before_open_square_brackets = false
|
||||
csharp_space_before_semicolon_in_for_statement = false
|
||||
csharp_space_between_empty_square_brackets = false
|
||||
csharp_space_between_method_call_empty_parameter_list_parentheses = false
|
||||
csharp_space_between_method_call_name_and_opening_parenthesis = false
|
||||
csharp_space_between_method_call_parameter_list_parentheses = false
|
||||
csharp_space_between_method_declaration_empty_parameter_list_parentheses = false
|
||||
csharp_space_between_method_declaration_name_and_open_parenthesis = false
|
||||
csharp_space_between_method_declaration_parameter_list_parentheses = false
|
||||
csharp_space_between_parentheses = false
|
||||
csharp_space_between_square_brackets = false
|
||||
|
||||
# Blocks are allowed
|
||||
csharp_prefer_braces = when_multiline:warning
|
||||
csharp_preserve_single_line_blocks = true
|
||||
csharp_preserve_single_line_statements = true
|
||||
|
||||
# Currently only enabled for C# due to crash in VB analyzer. VB can be enabled once
|
||||
# https://github.com/dotnet/roslyn/pull/54259 has been published.
|
||||
dotnet_style_allow_statement_immediately_after_block_experimental = false
|
||||
|
||||
# ignore unused value expression message
|
||||
csharp_style_unused_value_expression_statement_preference = discard_variable:none
|
||||
|
||||
# allow underscores in our enums
|
||||
dotnet_diagnostic.CA1707.severity = none
|
||||
|
||||
[OOT.API/Models/Contract/**.cs]
|
||||
# suppress analyzers in generated code
|
||||
dotnet_analyzer_diagnostic.severity = none
|
||||
|
||||
[src/CodeStyle/**.{cs,vb}]
|
||||
# warning RS0005: Do not use generic CodeAction.Create to create CodeAction
|
||||
dotnet_diagnostic.RS0005.severity = none
|
||||
|
||||
[src/{Analyzers,CodeStyle,Features,Workspaces,EditorFeatures,VisualStudio}/**/*.{cs,vb}]
|
||||
|
||||
# IDE0011: Add braces
|
||||
csharp_prefer_braces = when_multiline:warning
|
||||
# NOTE: We need the below severity entry for Add Braces due to https://github.com/dotnet/roslyn/issues/44201
|
||||
dotnet_diagnostic.IDE0011.severity = warning
|
||||
|
||||
# IDE0040: Add accessibility modifiers
|
||||
dotnet_diagnostic.IDE0040.severity = warning
|
||||
|
||||
# CONSIDER: Are IDE0051 and IDE0052 too noisy to be warnings for IDE editing scenarios? Should they be made build-only warnings?
|
||||
# IDE0051: Remove unused private member
|
||||
dotnet_diagnostic.IDE0051.severity = warning
|
||||
|
||||
# IDE0052: Remove unread private member
|
||||
dotnet_diagnostic.IDE0052.severity = warning
|
||||
|
||||
# IDE0059: Unnecessary assignment to a value
|
||||
dotnet_diagnostic.IDE0059.severity = warning
|
||||
|
||||
# IDE0060: Remove unused parameter
|
||||
dotnet_diagnostic.IDE0060.severity = warning
|
||||
|
||||
# CA1012: Abstract types should not have public constructors
|
||||
dotnet_diagnostic.CA1012.severity = warning
|
||||
|
||||
# CA1822: Make member static
|
||||
dotnet_diagnostic.CA1822.severity = warning
|
||||
|
||||
# Prefer "var" everywhere
|
||||
dotnet_diagnostic.IDE0007.severity = warning
|
||||
csharp_style_var_for_built_in_types = true:warning
|
||||
csharp_style_var_when_type_is_apparent = true:warning
|
||||
csharp_style_var_elsewhere = true:warning
|
||||
|
||||
# dotnet_style_allow_multiple_blank_lines_experimental
|
||||
dotnet_diagnostic.IDE2000.severity = warning
|
||||
|
||||
# csharp_style_allow_embedded_statements_on_same_line_experimental
|
||||
dotnet_diagnostic.IDE2001.severity = warning
|
||||
|
||||
# csharp_style_allow_blank_lines_between_consecutive_braces_experimental
|
||||
dotnet_diagnostic.IDE2002.severity = warning
|
||||
|
||||
# dotnet_style_allow_statement_immediately_after_block_experimental
|
||||
dotnet_diagnostic.IDE2003.severity = warning
|
||||
|
||||
# csharp_style_allow_blank_line_after_colon_in_constructor_initializer_experimental
|
||||
dotnet_diagnostic.IDE2004.severity = warning
|
||||
|
||||
[src/{VisualStudio}/**/*.{cs,vb}]
|
||||
# CA1822: Make member static
|
||||
# Not enforced as a build 'warning' for 'VisualStudio' layer due to large number of false positives from https://github.com/dotnet/roslyn-analyzers/issues/3857 and https://github.com/dotnet/roslyn-analyzers/issues/3858
|
||||
# Additionally, there is a risk of accidentally breaking an internal API that partners rely on though IVT.
|
||||
dotnet_diagnostic.CA1822.severity = suggestion
|
||||
311
src/Program.cs
Normal file
311
src/Program.cs
Normal file
|
|
@ -0,0 +1,311 @@
|
|||
using System.Globalization;
|
||||
using System.Net;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using Fido2NetLib;
|
||||
using Fido2NetLib.Objects;
|
||||
using Microsoft.Data.Sqlite;
|
||||
using SQLitePCL;
|
||||
|
||||
namespace WebauthnProxy;
|
||||
|
||||
public class AddKeyRequest {
|
||||
public required string Password { get; set; }
|
||||
public required AuthenticatorAttestationRawResponse Response { get; set; }
|
||||
}
|
||||
|
||||
public static class Program {
|
||||
private const string COOKIE_NAME = "__Secure-Token";
|
||||
private const string SESS_ATTESTATION_KEY = "fido2.attestationOptions";
|
||||
private const string SESS_ASSERTION_KEY = "fido2.assertionOptions";
|
||||
|
||||
private static readonly string s_loginHtmlCache = File.ReadAllText(Path.Combine(
|
||||
AppDomain.CurrentDomain.BaseDirectory, "login.html"));
|
||||
private static readonly string s_domain = Environment
|
||||
.GetEnvironmentVariable("WEBAUTHN_DOMAIN") ?? "localhost";
|
||||
private static readonly string s_db = Environment
|
||||
.GetEnvironmentVariable("WEBAUTHN_DB") ?? "credentials.db";
|
||||
private static readonly long s_lifetime = long.Parse(Environment
|
||||
.GetEnvironmentVariable("WEBAUTHN_LIFETIME") ?? "7",
|
||||
CultureInfo.InvariantCulture) * 60 * 60 * 24;
|
||||
private static readonly string? s_password = Environment
|
||||
.GetEnvironmentVariable("WEBAUTHN_PASSWORD");
|
||||
private static readonly int s_port = int.Parse(Environment
|
||||
.GetEnvironmentVariable("WEBAUTHN_PORT") ?? "5000",
|
||||
CultureInfo.InvariantCulture);
|
||||
private static readonly Fido2 s_fido2 = new(new Fido2Configuration {
|
||||
ServerDomain = s_domain,
|
||||
ServerName = "WebauthnProxy",
|
||||
Origins = new(new[] { $"http{(
|
||||
s_domain == "localhost"
|
||||
? string.Empty
|
||||
: "s")}://{s_domain}{(
|
||||
s_domain == "localhost"
|
||||
? $":{s_port}"
|
||||
: string.Empty)}" }),
|
||||
});
|
||||
private static readonly List<PublicKeyCredentialDescriptor> s_keys = new();
|
||||
|
||||
private static string ConnectionString { get => $"Data Source={s_db}"; }
|
||||
|
||||
public static void Main(string[] args) {
|
||||
var app = Initialize(args);
|
||||
app.UseSession();
|
||||
|
||||
app.MapGet("/favicon.ico", () => Results.File(Convert.FromBase64String(
|
||||
$"AAABAAEAEBAAAAAAAABoBQAAFgAAACgAAAAQAAAAIAAAAAEACAAAAAAAAAEAAAAAAAAAAAAAAAEAAAAAAAD///8{new string('A', 1788)}="),
|
||||
contentType: "image/x-icon"));
|
||||
|
||||
app.MapGet("/auth/check", async (context) => {
|
||||
var token = context.Request.Cookies[COOKIE_NAME];
|
||||
Console.WriteLine(token);
|
||||
if (!TokenIsValid(token)) {
|
||||
context.Response.ContentType = "text/plain";
|
||||
context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
|
||||
await context.Response.WriteAsync("unauthorized");
|
||||
return;
|
||||
}
|
||||
|
||||
context.Response.ContentType = "text/plain";
|
||||
context.Response.StatusCode = (int)HttpStatusCode.OK;
|
||||
await context.Response.WriteAsync("authorized");
|
||||
});
|
||||
|
||||
app.MapGet("/auth/login", async (context) => {
|
||||
context.Response.ContentType = "text/html";
|
||||
context.Response.StatusCode = (int)HttpStatusCode.OK;
|
||||
await context.Response.WriteAsync(s_loginHtmlCache);
|
||||
});
|
||||
|
||||
app.MapGet("/auth/logout", (context) => {
|
||||
if (context.Request.Cookies[COOKIE_NAME] == null)
|
||||
return Task.CompletedTask;
|
||||
|
||||
context.Response.Cookies.Append(COOKIE_NAME, string.Empty, new CookieOptions {
|
||||
Path = "/",
|
||||
Secure = true,
|
||||
HttpOnly = true,
|
||||
MaxAge = TimeSpan.Zero,
|
||||
Domain = s_domain,
|
||||
});
|
||||
|
||||
context.Response.Redirect("/");
|
||||
return Task.CompletedTask;
|
||||
});
|
||||
|
||||
app.MapPost("/auth/key", async (context) => {
|
||||
var options = s_fido2.GetAssertionOptions(
|
||||
s_keys, UserVerificationRequirement.Discouraged);
|
||||
context.Session.SetString(SESS_ASSERTION_KEY,
|
||||
JsonSerializer.Serialize(options));
|
||||
await context.Response.WriteAsJsonAsync(options);
|
||||
});
|
||||
|
||||
app.MapPost("/auth/complete", async (context) => {
|
||||
var assertionResponse = await context.Request
|
||||
.ReadFromJsonAsync<AuthenticatorAssertionRawResponse>();
|
||||
if (assertionResponse == null) {
|
||||
context.Response.StatusCode = 401;
|
||||
await context.Response.WriteAsJsonAsync(new { error = "bad response" });
|
||||
return;
|
||||
}
|
||||
|
||||
var optsJson = context.Session.GetString(SESS_ASSERTION_KEY);
|
||||
context.Session.Remove(SESS_ASSERTION_KEY);
|
||||
var opts = AssertionOptions.FromJson(optsJson);
|
||||
using var connection = new SqliteConnection(ConnectionString);
|
||||
connection.Open();
|
||||
byte[]? pubKey;
|
||||
using (var cmd = new SqliteCommand(
|
||||
"select key from credentials where id=@Id",
|
||||
connection)) {
|
||||
var param = cmd.CreateParameter();
|
||||
param.ParameterName = "@Id";
|
||||
param.Value = Convert.ToBase64String(assertionResponse.Id);
|
||||
cmd.Parameters.Add(param);
|
||||
pubKey = cmd.ExecuteScalar() is string keyStr
|
||||
? Convert.FromBase64String(keyStr)
|
||||
: null;
|
||||
if (pubKey == null) {
|
||||
context.Response.StatusCode = 401;
|
||||
await context.Response.WriteAsJsonAsync(new { error = "bad key" });
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
var res = await s_fido2.MakeAssertionAsync(
|
||||
assertionResponse, opts, pubKey, 0, (_, _) => Task.FromResult(true));
|
||||
if (res.Status != "ok") {
|
||||
context.Response.StatusCode = 401;
|
||||
await context.Response.WriteAsJsonAsync(new { error = "auth failed" });
|
||||
return;
|
||||
}
|
||||
|
||||
context.Response.Cookies.Append(
|
||||
COOKIE_NAME,
|
||||
GenerateToken(connection),
|
||||
new CookieOptions {
|
||||
Path = "/",
|
||||
Secure = true,
|
||||
HttpOnly = true,
|
||||
SameSite = SameSiteMode.None,
|
||||
Domain = s_domain,
|
||||
MaxAge = TimeSpan.FromSeconds(s_lifetime),
|
||||
});
|
||||
await context.Response.WriteAsJsonAsync(new { status = "ok" });
|
||||
});
|
||||
|
||||
app.MapPost("/auth/new-key", async (context) => {
|
||||
var user = new Fido2User {
|
||||
Id = Encoding.UTF8.GetBytes("default"),
|
||||
Name = "Default User",
|
||||
DisplayName = "Default User",
|
||||
};
|
||||
var options = s_fido2.RequestNewCredential(
|
||||
user,
|
||||
new List<PublicKeyCredentialDescriptor>(),
|
||||
AuthenticatorSelection.Default,
|
||||
AttestationConveyancePreference.None);
|
||||
context.Session.SetString(SESS_ATTESTATION_KEY,
|
||||
JsonSerializer.Serialize(options));
|
||||
|
||||
await context.Response.WriteAsJsonAsync(options);
|
||||
});
|
||||
|
||||
app.MapPost("/auth/add-key", async (context) => {
|
||||
var req = await context.Request.ReadFromJsonAsync<AddKeyRequest>();
|
||||
if (req == null) {
|
||||
context.Response.StatusCode = 400;
|
||||
return;
|
||||
}
|
||||
|
||||
if (string.IsNullOrEmpty(s_password)
|
||||
|| s_password != req.Password) {
|
||||
context.Response.StatusCode = 401;
|
||||
await context.Response.WriteAsJsonAsync(new { error = "bad password" });
|
||||
return;
|
||||
}
|
||||
|
||||
var optsJson = context.Session.GetString(SESS_ATTESTATION_KEY);
|
||||
context.Session.Remove(SESS_ATTESTATION_KEY);
|
||||
var opts = CredentialCreateOptions.FromJson(optsJson);
|
||||
var cred = await s_fido2.MakeNewCredentialAsync(
|
||||
req.Response, opts, (_, _) => Task.FromResult(true));
|
||||
var descriptor = new PublicKeyCredentialDescriptor(
|
||||
cred.Result!.CredentialId);
|
||||
|
||||
// store in list and save to database
|
||||
s_keys.Add(descriptor);
|
||||
using var connection = new SqliteConnection(ConnectionString);
|
||||
connection.Open();
|
||||
using var cmd = new SqliteCommand(
|
||||
@"insert into credentials (id, key) values (@Id, @Key)",
|
||||
connection);
|
||||
var idParam = cmd.CreateParameter();
|
||||
idParam.ParameterName = "@Id";
|
||||
idParam.Value = Convert.ToBase64String(cred.Result.CredentialId);
|
||||
var keyParam = cmd.CreateParameter();
|
||||
keyParam.ParameterName = "@Key";
|
||||
keyParam.Value = Convert.ToBase64String(cred.Result.PublicKey);
|
||||
cmd.Parameters.Add(idParam);
|
||||
cmd.Parameters.Add(keyParam);
|
||||
await cmd.ExecuteNonQueryAsync();
|
||||
});
|
||||
|
||||
app.Run($"http://0.0.0.0:{s_port}");
|
||||
}
|
||||
|
||||
private static string GenerateToken(SqliteConnection connection) {
|
||||
var rng = RandomNumberGenerator.Create();
|
||||
var bytes = new byte[32];
|
||||
rng.GetBytes(bytes);
|
||||
var token = Convert.ToBase64String(bytes);
|
||||
using var cmd = new SqliteCommand(@"insert into tokens (token) values (@Token)",
|
||||
connection);
|
||||
var param = cmd.CreateParameter();
|
||||
param.ParameterName = "@Token";
|
||||
param.Value = token;
|
||||
cmd.Parameters.Add(param);
|
||||
cmd.ExecuteNonQuery();
|
||||
return token;
|
||||
}
|
||||
|
||||
private static bool TokenIsValid(string? token) {
|
||||
if (string.IsNullOrWhiteSpace(token)) return false;
|
||||
|
||||
using var connection = new SqliteConnection(ConnectionString);
|
||||
connection.Open();
|
||||
using var cmd = new SqliteCommand(
|
||||
@"select 1 from tokens where
|
||||
token=@Token
|
||||
and julianday(created_date, @Timeout) > julianday(CURRENT_TIMESTAMP)",
|
||||
connection);
|
||||
var tokenParam = cmd.CreateParameter();
|
||||
tokenParam.ParameterName = "@Token";
|
||||
tokenParam.Value = token;
|
||||
var timeoutParam = cmd.CreateParameter();
|
||||
timeoutParam.ParameterName = "@Timeout";
|
||||
timeoutParam.Value = $"+{s_lifetime} seconds";
|
||||
cmd.Parameters.Add(tokenParam);
|
||||
cmd.Parameters.Add(timeoutParam);
|
||||
return cmd.ExecuteScalar() != null;
|
||||
}
|
||||
|
||||
private static void RemoveExpiredTokens() {
|
||||
using var connection = new SqliteConnection(ConnectionString);
|
||||
connection.Open();
|
||||
using var cmd = new SqliteCommand(
|
||||
@"delete from tokens where
|
||||
julianday(created_date, @Timeout) < julianday(CURRENT_TIMESTAMP)",
|
||||
connection);
|
||||
var timeoutParam = cmd.CreateParameter();
|
||||
timeoutParam.ParameterName = "@Timeout";
|
||||
timeoutParam.Value = $"+{s_lifetime} seconds";
|
||||
cmd.Parameters.Add(timeoutParam);
|
||||
cmd.ExecuteNonQuery();
|
||||
}
|
||||
|
||||
private static WebApplication Initialize(string[] args) {
|
||||
Batteries.Init();
|
||||
|
||||
using var connection = new SqliteConnection(ConnectionString);
|
||||
connection.Open();
|
||||
using (var cmd = new SqliteCommand(
|
||||
@"select 1 from sqlite_master
|
||||
where type='table' and name='credentials'",
|
||||
connection)) {
|
||||
var exists = cmd.ExecuteScalar();
|
||||
if (exists == null) {
|
||||
var schemaPath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "schema.sql");
|
||||
if (!File.Exists(schemaPath)) {
|
||||
throw new FileNotFoundException(schemaPath);
|
||||
}
|
||||
|
||||
var schema = File.ReadAllText(schemaPath);
|
||||
using var schemaCmd = new SqliteCommand(schema, connection);
|
||||
schemaCmd.ExecuteNonQuery();
|
||||
}
|
||||
}
|
||||
|
||||
RemoveExpiredTokens();
|
||||
|
||||
// read credentials
|
||||
using (var cmd = new SqliteCommand(
|
||||
@"select id from credentials",
|
||||
connection)) {
|
||||
var reader = cmd.ExecuteReader();
|
||||
while (reader.Read()) {
|
||||
var id = reader.GetString(0);
|
||||
var desc = new PublicKeyCredentialDescriptor(
|
||||
Convert.FromBase64String(id));
|
||||
if (desc != null) s_keys.Add(desc);
|
||||
}
|
||||
}
|
||||
|
||||
var builder = WebApplication.CreateBuilder(args);
|
||||
builder.Services.AddDistributedMemoryCache();
|
||||
builder.Services.AddSession();
|
||||
return builder.Build();
|
||||
}
|
||||
}
|
||||
102
src/login.html
Normal file
102
src/login.html
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
<!doctype html>
|
||||
<html lang='en'>
|
||||
<body>
|
||||
<script>
|
||||
function atobarray(sBase64) {
|
||||
const sBinaryString = atob(sBase64.replace(/-/g, '+').replace(/_/g, '/'));
|
||||
const aBinaryView = new Uint8Array(sBinaryString.length);
|
||||
Array.prototype.forEach.call(aBinaryView, function (el, idx, arr) {
|
||||
arr[idx] = sBinaryString.charCodeAt(idx);
|
||||
});
|
||||
return aBinaryView;
|
||||
}
|
||||
|
||||
function barraytoa(arrayBuffer) {
|
||||
return btoa(String.fromCharCode(...new Uint8Array(arrayBuffer)));
|
||||
}
|
||||
|
||||
async function configure() {
|
||||
try {
|
||||
const data = await fetch('/auth/new-key', {
|
||||
method: 'POST'
|
||||
});
|
||||
const json = await data.json();
|
||||
json.challenge = atobarray(json.challenge);
|
||||
json.user.id = atobarray(json.user.id);
|
||||
const cred = await navigator.credentials.create({ publicKey: json });
|
||||
var password = prompt('Administrative Password');
|
||||
const addResp = await fetch('/auth/add-key', {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
body: JSON.stringify({
|
||||
password,
|
||||
response : {
|
||||
id: cred.id,
|
||||
rawId: barraytoa(cred.rawId),
|
||||
type: cred.type,
|
||||
response: {
|
||||
clientDataJSON: barraytoa(cred.response.clientDataJSON),
|
||||
attestationObject: barraytoa(cred.response.attestationObject),
|
||||
},
|
||||
},
|
||||
}),
|
||||
});
|
||||
} catch (e) {
|
||||
console.log(e)
|
||||
}
|
||||
}
|
||||
|
||||
(async function init() {
|
||||
try {
|
||||
const data = await fetch('/auth/key', {
|
||||
method: 'POST'
|
||||
});
|
||||
const json = await data.json();
|
||||
let result;
|
||||
if (json.allowCredentials !== undefined && json.allowCredentials.length > 0) {
|
||||
json.challenge = atobarray(json.challenge);
|
||||
for (let i = 0; i < json.allowCredentials.length; i++) {
|
||||
json.allowCredentials[i].id =
|
||||
atobarray(json.allowCredentials[i].id);
|
||||
}
|
||||
try {
|
||||
result = await navigator.credentials.get({ publicKey: json });
|
||||
} catch(e) {
|
||||
console.log(e);
|
||||
await configure();
|
||||
return;
|
||||
}
|
||||
await fetch('/auth/complete', {
|
||||
method: 'POST',
|
||||
body: JSON.stringify({
|
||||
id: result.id,
|
||||
rawId: barraytoa(result.rawId),
|
||||
type: result.type,
|
||||
response: {
|
||||
authenticatorData: barraytoa(result.response.authenticatorData),
|
||||
clientDataJSON: barraytoa(result.response.clientDataJSON),
|
||||
signature: barraytoa(result.response.signature),
|
||||
},
|
||||
}),
|
||||
headers: { 'Content-Type': 'application/json' }
|
||||
});
|
||||
const params = await new URLSearchParams(window.location.search);
|
||||
if (params.has('target')) {
|
||||
window.location.href = params.get('target');
|
||||
} else {
|
||||
window.location.href = '/';
|
||||
}
|
||||
} else {
|
||||
await configure();
|
||||
window.location.href='/auth/login';
|
||||
}
|
||||
} catch(e) {
|
||||
console.log(e);
|
||||
}
|
||||
})()
|
||||
</script>
|
||||
<div id="command"></div>
|
||||
</body>
|
||||
</html>
|
||||
8
src/omnisharp.json
Normal file
8
src/omnisharp.json
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"RoslynExtensionsOptions": {
|
||||
"enableAnalyzersSupport": true
|
||||
},
|
||||
"FormattingOptions": {
|
||||
"enableEditorConfigSupport": true
|
||||
}
|
||||
}
|
||||
10
src/schema.sql
Normal file
10
src/schema.sql
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
create table credentials (
|
||||
id text primary key,
|
||||
key text not null,
|
||||
created_date datetime not null default CURRENT_TIMESTAMP
|
||||
);
|
||||
|
||||
create table tokens (
|
||||
token text primary key,
|
||||
created_date datetime not null default CURRENT_TIMESTAMP
|
||||
);
|
||||
24
src/webauthn-proxy.csproj
Normal file
24
src/webauthn-proxy.csproj
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
<Project Sdk="Microsoft.NET.Sdk.Web">
|
||||
|
||||
<PropertyGroup>
|
||||
<TargetFramework>net7.0</TargetFramework>
|
||||
<Nullable>enable</Nullable>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
</PropertyGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<PackageReference Include="Fido2" Version="3.0.1" />
|
||||
<PackageReference Include="Fido2.Models" Version="3.0.1" />
|
||||
<PackageReference Include="Microsoft.Data.SQLite" Version="7.0.5" />
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<Content Include="schema.sql">
|
||||
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
|
||||
</Content>
|
||||
<Content Include="login.html">
|
||||
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
|
||||
</Content>
|
||||
</ItemGroup>
|
||||
|
||||
</Project>
|
||||
Loading…
Reference in a new issue