qup42 / django-aletheia Goto Github PK

View Code? Open in Web Editor NEW

0.0 1.0 1.0 55 KB

WebAuthN support for Django. Provided with a custom AuthBackend.

License: BSD 3-Clause "New" or "Revised" License

Python 77.03% HTML 22.97%

authentication django webauthn

django-aletheia's Issues

Switch Resident Key to Client Side Discoverable

See https://www.w3.org/TR/webauthn-2/#enum-residentKeyRequirement

This would even remove the need to specify the username. Would obsolete 14.6.3 in #12. Would also remove the need to have the username in login_config in views.py

Improve Admin Interface

Add Register Site

This site should allow to set names for the keys

unnecessary import

unnecessary import of timezone.

django-aletheia/aletheia/auth_backends.py

Lines 4 to 5 in ed82688

 from django.utils import timezone 

 from django.utils.timezone import now

Information leak in auth_backend

expired keys are rejected befor checked for legitamacy.
This can be abused for checking if a user has loged in in the last 6 months.

django-aletheia/aletheia/auth_backends.py

Lines 42 to 60 in ed82688

 if credential.user.webauthnuser.last_login_with_password + relativedelta(months=6) < timezone.now(): 

 messages.error(request, f"Authentication with WebAuthN failed. Please login with password.", 

 fail_silently=True) 

 return None 

 try: 

 authentication_verification = verify_authentication_response( 

 credential=AuthenticationCredential.parse_raw(data), 

 expected_challenge=challenge.encode("utf-8"), 

 expected_rp_id=settings.RELYING_PARTY_ID, 

 expected_origin=settings.EXPECTED_ORIGIN, 

 require_user_verification=False, 

 credential_current_sign_count=credential.sign_count, 

 credential_public_key=base64decode(credential.public_key) 

 ) 

 except InvalidAuthenticationResponse: 

 # TODO: give concrete feedback about why the authentication failed? 

 messages.error(request, f"Authentication failed", fail_silently=True) 

 return None

Improve Privacy

Implement
14.6.2. https://w3c.github.io/webauthn/#sctn-username-enumeration
14.6.3. https://w3c.github.io/webauthn/#sctn-credential-id-privacy-leak

Make code more resilient to failures

E.g.

selection of non existent user in frontend to login (-> scripts.html)

Change AJAX CSRF Token source to Cookie

See https://docs.djangoproject.com/en/4.0/ref/csrf/#ajax

Write Tests

Check whether WebAuthN is available at all in scripts.html

https://developer.mozilla.org/en-US/docs/Web/API/Navigator/credentials

Add logging

https://docs.djangoproject.com/en/4.0/howto/logging/#logging-how-to

Way to add WebAuthNUser for existing user

management task?

Add Manage Site

This should allow to view all registered keys and delete registered keys.

qup42 / django-aletheia Goto Github PK

django-aletheia's Issues

Switch Resident Key to Client Side Discoverable

Improve Admin Interface

Add Register Site

unnecessary import

Information leak in auth_backend

Improve Privacy

Make code more resilient to failures

Change AJAX CSRF Token source to Cookie

Write Tests

Check whether WebAuthN is available at all in scripts.html

Add logging

Way to add WebAuthNUser for existing user

Add Manage Site

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

Jobs

	from django.utils import timezone
	from django.utils.timezone import now

	if credential.user.webauthnuser.last_login_with_password + relativedelta(months=6) < timezone.now():
	messages.error(request, f"Authentication with WebAuthN failed. Please login with password.",
	fail_silently=True)
	return None

	try:
	authentication_verification = verify_authentication_response(
	credential=AuthenticationCredential.parse_raw(data),
	expected_challenge=challenge.encode("utf-8"),
	expected_rp_id=settings.RELYING_PARTY_ID,
	expected_origin=settings.EXPECTED_ORIGIN,
	require_user_verification=False,
	credential_current_sign_count=credential.sign_count,
	credential_public_key=base64decode(credential.public_key)
	)
	except InvalidAuthenticationResponse:
	# TODO: give concrete feedback about why the authentication failed?
	messages.error(request, f"Authentication failed", fail_silently=True)
	return None