feat: support webauthn #422

Wellaiyo · 2023-03-06T12:20:00Z

webauth 由 authentication 改造为 session，并增加 web 登录页面，更安全
支持 webauthn 的登录方式，可通过配置控制（默认关闭），更高效

use session instead http authentication on webauth
support webauthn, you should set enableWebAuthn: true in the configuration

socket-security · 2023-03-06T12:20:48Z

New dependency changes detected. Learn more about Socket for GitHub ↗︎

👍 No new dependency issues detected in pull request

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

Ignoring: cbor-extract@2.1.1

Pull request alert summary

Issue	Status
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

📊 Modified Dependency Overview:

➕ Added Package	Capability Access	`+/-` Transitive Count	Publisher
egg-view-nunjucks@2.3.0	None	`+3`	atian25
@simplewebauthn/typescript-types@7.0.0	None	`+0`	iamkale
base64url@3.0.1	None	`+0`	brianloveswords
@simplewebauthn/server@7.2.0	None	`+28`	iamkale
ua-parser-js@1.0.34	None	`+0`	faisalman

fengmk2 · 2023-03-06T12:25:19Z

@elrrrrrrr 也来看看。

codecov · 2023-03-06T12:27:21Z

Codecov Report

Merging #422 (5f75c7a) into master (300f0e4) will decrease coverage by 0.58%.
The diff coverage is 83.95%.

@@            Coverage Diff             @@
##           master     #422      +/-   ##
==========================================
- Coverage   97.66%   97.08%   -0.58%     
==========================================
  Files         153      156       +3     
  Lines       13632    13981     +349     
  Branches     1755     1783      +28     
==========================================
+ Hits        13314    13574     +260     
- Misses        318      407      +89

Impacted Files	Coverage Δ
app/port/webauth/WebauthController.ts	`84.77% <73.50%> (-15.23%)`	⬇️
app/repository/UserRepository.ts	`91.81% <80.00%> (-4.44%)`	⬇️
app/core/service/UserService.ts	`95.13% <85.71%> (-2.22%)`	⬇️
app/common/CryptoUtil.ts	`100.00% <100.00%> (ø)`
app/common/UserUtil.ts	`100.00% <100.00%> (ø)`
app/common/enum/User.ts	`100.00% <100.00%> (ø)`
app/core/entity/WebauthnCredential.ts	`100.00% <100.00%> (ø)`
app/repository/model/WebauthnCredential.ts	`100.00% <100.00%> (ø)`
config/config.default.ts	`88.23% <100.00%> (-7.84%)`	⬇️
config/plugin.ts	`100.00% <100.00%> (ø)`

... and 2 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

app/common/CryptoUtil.ts

app/port/UserRoleManager.ts

app/port/webauth/WebauthController.ts

Wellaiyo · 2023-03-08T10:42:27Z

兼容性上主要考量Chrome、Safari、Firefox、Edge，在限制只能使用内置认证器的基础上，Chrome和Edge无缝支持，Safari会引导开启iCloud钥匙才能用，macOS下Firefox不支持，且在macOS上不支持跨浏览器认证

app/port/webauth/WebauthController.ts

fengmk2 · 2023-03-24T09:45:32Z

@Wellaiyo 解决一下冲突，我准备合并了。

package.json

fengmk2 · 2023-03-25T03:06:45Z

@Wellaiyo SQL review 修复一下 https://github.com/cnpm/cnpmcore/actions/runs/4510422096/jobs/7941411678?pr=422

test/port/controller/package/ShowPackageController.test.ts

package.json

sql/1.13.0.sql

fengmk2 · 2023-03-25T03:25:26Z

@Wellaiyo nunjucks 插件需要开启一下

2023-03-25 11:24:44,217 WARN 42604 Following plugins will be enabled implicitly that is disabled by application.
  - view required by [nunjucks]

fengmk2 · 2023-03-25T03:33:06Z

本地跑了一下体验还不错， @Wellaiyo 几个问题修复一下就可以合并发布了。

fengmk2 · 2023-03-25T03:39:22Z

fengmk2 · 2023-03-25T03:47:10Z

有一个问题，如果用户换了浏览器就无法登录了

app/core/entity/User.ts

fengmk2 · 2023-03-27T09:44:28Z

app/common/UserUtil.ts

+  if (!ua) return null;
+  const os = ua.getOS();
+  if (os.name === 'iOS' || os.name === 'Android') return 'mobile';
+  if (os.name === 'Mac OS') return ua.getBrowser().name;


Windows 和 Linux 不支持？

支持，只是不需要特别标明。目前已知的是仅Mac OS下PC端才不支持跨浏览器

fengmk2

+1

fengmk2 · 2023-03-27T09:48:31Z

@SocketSecurity ignore cbor-extract@2.1.1

[skip ci] ## [3.11.0](v3.10.0...v3.11.0) (2023-03-27) ### Features * support webauthn ([#422](#422)) ([1b8512b](1b8512b))

github-actions · 2023-03-27T10:28:53Z

🎉 This PR is included in version 3.11.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

lanxiu.lwl added 3 commits March 6, 2023 17:54

feat: support webauthn

897cbf8

add try catch for navigator.credentials.xxx

c4f72fb

set config enableWebAuthn to false

bb62a10

fengmk2 requested review from elrrrrrrr and fengmk2 March 6, 2023 12:24

elrrrrrrr reviewed Mar 7, 2023

View reviewed changes

app/common/CryptoUtil.ts Show resolved Hide resolved

elrrrrrrr reviewed Mar 7, 2023

View reviewed changes

app/port/UserRoleManager.ts Outdated Show resolved Hide resolved

elrrrrrrr reviewed Mar 7, 2023

View reviewed changes

app/port/webauth/WebauthController.ts Outdated Show resolved Hide resolved

elrrrrrrr reviewed Mar 7, 2023

View reviewed changes

app/port/webauth/WebauthController.ts Show resolved Hide resolved

lanxiu.lwl added 6 commits March 7, 2023 15:16

use crypto instead node-rsa

77fdf61

remove user/token in session

e69cc4e

update wan_c_id/wan_c_public_key column type

0af4f8a

add sign up

d071ab9

remove challenge/privateKey in session

49deab7

macOS firefox not support webauthn

b11accf

Merge branch 'master' into support-webauthn

eb8c2ae

fengmk2 reviewed Mar 16, 2023

View reviewed changes

app/port/webauth/WebauthController.ts Show resolved Hide resolved

fengmk2 reviewed Mar 16, 2023

View reviewed changes

app/port/webauth/WebauthController.ts Show resolved Hide resolved

fengmk2 added the enhancement New feature or request label Mar 24, 2023

fengmk2 mentioned this pull request Mar 24, 2023

WebAuthn #236

Closed

Merge branch 'master' into support-webauthn

8ade8b1

Wellaiyo closed this Mar 24, 2023

Wellaiyo reopened this Mar 24, 2023

fengmk2 reviewed Mar 24, 2023

View reviewed changes

package.json Show resolved Hide resolved

fengmk2 reviewed Mar 25, 2023

View reviewed changes

test/port/controller/package/ShowPackageController.test.ts Show resolved Hide resolved

fengmk2 reviewed Mar 25, 2023

View reviewed changes

package.json Outdated Show resolved Hide resolved

fengmk2 reviewed Mar 25, 2023

View reviewed changes

sql/1.13.0.sql Outdated Show resolved Hide resolved

fengmk2 reviewed Mar 25, 2023

View reviewed changes

app/core/entity/User.ts Outdated Show resolved Hide resolved

lanxiu.lwl added 2 commits March 27, 2023 16:28

webauthn better compatibility

6a849e0

can unbind touch id/face id

5f75c7a

fengmk2 reviewed Mar 27, 2023

View reviewed changes

fengmk2 approved these changes Mar 27, 2023

View reviewed changes

fengmk2 merged commit 1b8512b into cnpm:master Mar 27, 2023

fengmk2 pushed a commit that referenced this pull request Mar 27, 2023

Release 3.11.0

9d66d35

[skip ci] ## [3.11.0](v3.10.0...v3.11.0) (2023-03-27) ### Features * support webauthn ([#422](#422)) ([1b8512b](1b8512b))

github-actions bot added the released label Mar 27, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support webauthn #422

feat: support webauthn #422

Wellaiyo commented Mar 6, 2023 •

edited by fengmk2

Loading

socket-security bot commented Mar 6, 2023 •

edited

Loading

fengmk2 commented Mar 6, 2023

codecov bot commented Mar 6, 2023 •

edited

Loading

Wellaiyo commented Mar 8, 2023

fengmk2 commented Mar 24, 2023

fengmk2 commented Mar 25, 2023

fengmk2 commented Mar 25, 2023

fengmk2 commented Mar 25, 2023

fengmk2 commented Mar 25, 2023 •

edited

Loading

fengmk2 commented Mar 25, 2023

fengmk2 Mar 27, 2023

Wellaiyo Mar 27, 2023

fengmk2 left a comment

fengmk2 commented Mar 27, 2023

github-actions bot commented Mar 27, 2023

feat: support webauthn #422

feat: support webauthn #422

Conversation

Wellaiyo commented Mar 6, 2023 • edited by fengmk2 Loading

socket-security bot commented Mar 6, 2023 • edited Loading

fengmk2 commented Mar 6, 2023

codecov bot commented Mar 6, 2023 • edited Loading

Codecov Report

Wellaiyo commented Mar 8, 2023

fengmk2 commented Mar 24, 2023

fengmk2 commented Mar 25, 2023

fengmk2 commented Mar 25, 2023

fengmk2 commented Mar 25, 2023

fengmk2 commented Mar 25, 2023 • edited Loading

fengmk2 commented Mar 25, 2023

fengmk2 Mar 27, 2023

Choose a reason for hiding this comment

Wellaiyo Mar 27, 2023

Choose a reason for hiding this comment

fengmk2 left a comment

Choose a reason for hiding this comment

fengmk2 commented Mar 27, 2023

github-actions bot commented Mar 27, 2023

Wellaiyo commented Mar 6, 2023 •

edited by fengmk2

Loading

socket-security bot commented Mar 6, 2023 •

edited

Loading

codecov bot commented Mar 6, 2023 •

edited

Loading

fengmk2 commented Mar 25, 2023 •

edited

Loading