Skip to content

Commit 00763f3

Browse files
nicolastemciucnicolastemciuc
committed
feat: allow any top origin via :allow_all
1 parent 7a2236c commit 00763f3

4 files changed

Lines changed: 223 additions & 10 deletions

File tree

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,10 @@ WebAuthn.configure do |config|
126126
#
127127
# config.allowed_top_origins = []
128128
#
129+
# (C) Allow all top-level origins:
130+
#
131+
# config.allowed_top_origins = :allow_all
132+
#
129133
# Note: if `verify_cross_origin` is not enabled, any values set in `allowed_top_origins`
130134
# will be ignored.
131135

‎lib/webauthn/authenticator_response.rb‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,10 @@ def valid_token_binding?
8787
end
8888

8989
def valid_top_origin?
90-
return false unless client_data.cross_origin
90+
return false unless client_data.cross_origin && client_data.top_origin
9191

92-
relying_party.allowed_top_origins&.include?(client_data.top_origin)
92+
relying_party.allowed_top_origins == :allow_all ||
93+
relying_party.allowed_top_origins&.include?(client_data.top_origin)
9394
end
9495

9596
def valid_challenge?(expected_challenge)

‎spec/webauthn/authenticator_assertion_response_spec.rb‎

Lines changed: 108 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -373,8 +373,8 @@
373373
end
374374
end
375375

376-
context "when allowed_top_origins is set" do
377-
let(:allowed_top_origins) { [top_origin] }
376+
context "when allowed_top_origins is a collection of origins" do
377+
let(:allowed_top_origins) { [top_origin, "http://another.example.com"] }
378378

379379
context "when cross_origin is true" do
380380
let(:cross_origin) { true }
@@ -448,6 +448,58 @@
448448
end
449449
end
450450
end
451+
452+
context "when allowed_top_origins is :allow_all" do
453+
let(:allowed_top_origins) { :allow_all }
454+
455+
context "when cross_origin is true" do
456+
let(:cross_origin) { true }
457+
458+
context "when top_origin is set" do
459+
let(:client_top_origin) { top_origin }
460+
461+
it_behaves_like "a valid assertion response"
462+
end
463+
464+
context "when top_origin is not set" do
465+
let(:client_top_origin) { nil }
466+
467+
it_behaves_like "a valid assertion response"
468+
end
469+
end
470+
471+
context "when cross_origin is false" do
472+
let(:cross_origin) { false }
473+
474+
context "when top_origin is set" do
475+
let(:client_top_origin) { top_origin }
476+
477+
it_behaves_like "a valid assertion response"
478+
end
479+
480+
context "when top_origin is not set" do
481+
let(:client_top_origin) { nil }
482+
483+
it_behaves_like "a valid assertion response"
484+
end
485+
end
486+
487+
context "when cross_origin is not set" do
488+
let(:cross_origin) { nil }
489+
490+
context "when top_origin is set" do
491+
let(:client_top_origin) { top_origin }
492+
493+
it_behaves_like "a valid assertion response"
494+
end
495+
496+
context "when top_origin is not set" do
497+
let(:client_top_origin) { nil }
498+
499+
it_behaves_like "a valid assertion response"
500+
end
501+
end
502+
end
451503
end
452504

453505
context "when verify_cross_origin is true" do
@@ -505,8 +557,8 @@
505557
end
506558
end
507559

508-
context "when allowed_top_origins is set" do
509-
let(:allowed_top_origins) { [top_origin] }
560+
context "when allowed_top_origins is a collection of origins" do
561+
let(:allowed_top_origins) { [top_origin, "http://another.example.com"] }
510562

511563
context "when cross_origin is true" do
512564
let(:cross_origin) { true }
@@ -580,6 +632,58 @@
580632
end
581633
end
582634
end
635+
636+
context "when allowed_top_origins is :allow_all" do
637+
let(:allowed_top_origins) { :allow_all }
638+
639+
context "when cross_origin is true" do
640+
let(:cross_origin) { true }
641+
642+
context "when top_origin is set" do
643+
let(:client_top_origin) { top_origin }
644+
645+
it_behaves_like "a valid assertion response"
646+
end
647+
648+
context "when top_origin is not set" do
649+
let(:client_top_origin) { nil }
650+
651+
it_behaves_like "an invalid assertion response that raises", WebAuthn::TopOriginVerificationError
652+
end
653+
end
654+
655+
context "when cross_origin is false" do
656+
let(:cross_origin) { false }
657+
658+
context "when top_origin is set" do
659+
let(:client_top_origin) { top_origin }
660+
661+
it_behaves_like "an invalid assertion response that raises", WebAuthn::TopOriginVerificationError
662+
end
663+
664+
context "when top_origin is not set" do
665+
let(:client_top_origin) { nil }
666+
667+
it_behaves_like "a valid assertion response"
668+
end
669+
end
670+
671+
context "when cross_origin is not set" do
672+
let(:cross_origin) { nil }
673+
674+
context "when top_origin is set" do
675+
let(:client_top_origin) { top_origin }
676+
677+
it_behaves_like "an invalid assertion response that raises", WebAuthn::TopOriginVerificationError
678+
end
679+
680+
context "when top_origin is not set" do
681+
let(:client_top_origin) { nil }
682+
683+
it_behaves_like "a valid assertion response"
684+
end
685+
end
686+
end
583687
end
584688
end
585689

‎spec/webauthn/authenticator_attestation_response_spec.rb‎

Lines changed: 108 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -702,8 +702,8 @@
702702
end
703703
end
704704

705-
context "when allowed_top_origins is set" do
706-
let(:allowed_top_origins) { [top_origin] }
705+
context "when allowed_top_origins is a collection of origins" do
706+
let(:allowed_top_origins) { [top_origin, "https://another.example.com"] }
707707

708708
context "when cross_origin is true" do
709709
let(:cross_origin) { true }
@@ -777,6 +777,58 @@
777777
end
778778
end
779779
end
780+
781+
context "when allowed_top_origins is :allow_all" do
782+
let(:allowed_top_origins) { :allow_all }
783+
784+
context "when cross_origin is true" do
785+
let(:cross_origin) { true }
786+
787+
context "when top_origin is set" do
788+
let(:client_top_origin) { top_origin }
789+
790+
it_behaves_like "a valid attestation response"
791+
end
792+
793+
context "when top_origin is not set" do
794+
let(:client_top_origin) { nil }
795+
796+
it_behaves_like "a valid attestation response"
797+
end
798+
end
799+
800+
context "when cross_origin is false" do
801+
let(:cross_origin) { false }
802+
803+
context "when top_origin is set" do
804+
let(:client_top_origin) { top_origin }
805+
806+
it_behaves_like "a valid attestation response"
807+
end
808+
809+
context "when top_origin is not set" do
810+
let(:client_top_origin) { nil }
811+
812+
it_behaves_like "a valid attestation response"
813+
end
814+
end
815+
816+
context "when cross_origin is not set" do
817+
let(:cross_origin) { nil }
818+
819+
context "when top_origin is set" do
820+
let(:client_top_origin) { top_origin }
821+
822+
it_behaves_like "a valid attestation response"
823+
end
824+
825+
context "when top_origin is not set" do
826+
let(:client_top_origin) { nil }
827+
828+
it_behaves_like "a valid attestation response"
829+
end
830+
end
831+
end
780832
end
781833

782834
context "when verify_cross_origin is true" do
@@ -834,8 +886,8 @@
834886
end
835887
end
836888

837-
context "when allowed_top_origins is set" do
838-
let(:allowed_top_origins) { [top_origin] }
889+
context "when allowed_top_origins is a collection of origins" do
890+
let(:allowed_top_origins) { [top_origin, "https://another.example.com"] }
839891

840892
context "when cross_origin is true" do
841893
let(:cross_origin) { true }
@@ -909,6 +961,58 @@
909961
end
910962
end
911963
end
964+
965+
context "when allowed_top_origins is :allow_all" do
966+
let(:allowed_top_origins) { :allow_all }
967+
968+
context "when cross_origin is true" do
969+
let(:cross_origin) { true }
970+
971+
context "when top_origin is set" do
972+
let(:client_top_origin) { top_origin }
973+
974+
it_behaves_like "a valid attestation response"
975+
end
976+
977+
context "when top_origin is not set" do
978+
let(:client_top_origin) { nil }
979+
980+
it_behaves_like "an invalid attestation response that raises", WebAuthn::TopOriginVerificationError
981+
end
982+
end
983+
984+
context "when cross_origin is false" do
985+
let(:cross_origin) { false }
986+
987+
context "when top_origin is set" do
988+
let(:client_top_origin) { top_origin }
989+
990+
it_behaves_like "an invalid attestation response that raises", WebAuthn::TopOriginVerificationError
991+
end
992+
993+
context "when top_origin is not set" do
994+
let(:client_top_origin) { nil }
995+
996+
it_behaves_like "a valid attestation response"
997+
end
998+
end
999+
1000+
context "when cross_origin is not set" do
1001+
let(:cross_origin) { nil }
1002+
1003+
context "when top_origin is set" do
1004+
let(:client_top_origin) { top_origin }
1005+
1006+
it_behaves_like "an invalid attestation response that raises", WebAuthn::TopOriginVerificationError
1007+
end
1008+
1009+
context "when top_origin is not set" do
1010+
let(:client_top_origin) { nil }
1011+
1012+
it_behaves_like "a valid attestation response"
1013+
end
1014+
end
1015+
end
9121016
end
9131017
end
9141018

0 commit comments

Comments
 (0)