clientData sending invalid tokenBinding status about kr-u2f

[frankh]

Can confirm github works too

(this is good for me upping all my security 😄 )

[agrinman]

@frankh what site is this for? I thought chrome dropped support for the token binding standard anyways..?

[frankh]

I've done some more research and it seems that token-binding is not supported anywhere

It's a private project that's requiring this flag, i'll bug them to remove the requirement.

[frankh]

Actually, it does look like this is a bug

According to the spec[1], the only valid values for this field are "supported" and "present" - so "not-supported" causes it to be rejected, but skipping the field entirely works.

I think the fix is to simply remove the field from the clientData here

kr-u2f/src/background.ts

Line 164 in f9599d4

tokenBinding: {

[1] https://www.w3.org/TR/webauthn/#dom-collectedclientdata-tokenbinding

[frankh]

Created a PR here #30

[frankh]

It seems this was valid at some point, but is no longer, see: w3c/webauthn#914

[agrinman]

While the PR looks good wrt to the spec, I wonder if this will break other sites that maybe also don’t realize this spec change (especially sites that support U2F only). Have you tested this change with sites like Google, Dropbox, etc...?

[frankh]

I just tested with Google and Dropbox and can confirm they still work. It also seems that my Yubikey 5C doesn't send this field in clientData, so anything that supports that should work with this change

[agrinman]

Hm I would also test with a site that is U2F only i.e maybe GitHub & GitLab (Google and Dropbox both are webauthn). Might need to set/send the field differently based upon the protocol but I'm not sure.

[frankh]

hi, just wondering if you're considering merging this?

[agrinman]

Sorry for the delay, I had merged this a little while back.