mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-08 20:37:43 +00:00
silverwind
9dac77fdc2
Registration omitted `userVerification`, so Chromium raised the credential to credProtect level 3 and the authenticator then hid it from the second-factor login, which asked for `discouraged`. Registration and each login now set their own value, with `preferred` on the second factor so credentials already registered at level 3 keep working without re-enrollment. Also add relevant e2e test coverage for webauthn, one test chromium only because Firefox lacks the APIs needed. Fixes https://github.com/go-gitea/gitea/issues/33531 Fixes https://github.com/go-gitea/gitea/issues/36019 Fixes https://github.com/go-gitea/gitea/issues/38139
39 lines
1.6 KiB
Go
39 lines
1.6 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/go-webauthn/webauthn/protocol"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
// one credential serves both logins, so their user verification is coupled
|
|
func TestWebAuthnUserVerification(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user2")
|
|
req := NewRequestWithValues(t, "POST", "/user/settings/security/webauthn/request_register", map[string]string{"name": "test-key"})
|
|
creation := DecodeJSON(t, session.MakeRequest(t, req, http.StatusOK), &protocol.CredentialCreation{})
|
|
assert.Equal(t, protocol.VerificationRequired, creation.Response.AuthenticatorSelection.UserVerification)
|
|
|
|
session = loginUserWithPassword(t, "user32", "notpassword") // user32 has a webauthn credential
|
|
req = NewRequest(t, "GET", "/user/webauthn/assertion")
|
|
secondFactor := DecodeJSON(t, session.MakeRequest(t, req, http.StatusOK), &protocol.CredentialAssertion{})
|
|
assert.Equal(t, protocol.VerificationPreferred, secondFactor.Response.UserVerification)
|
|
|
|
session = emptyTestSession(t)
|
|
req = NewRequest(t, "GET", "/user/webauthn/passkey/assertion") // also seeds the session for the request below
|
|
passkey := DecodeJSON(t, session.MakeRequest(t, req, http.StatusOK), &protocol.CredentialAssertion{})
|
|
assert.Equal(t, protocol.VerificationRequired, passkey.Response.UserVerification)
|
|
|
|
// a malformed response used to dereference a nil user
|
|
req = NewRequestWithJSON(t, "POST", "/user/webauthn/passkey/login", map[string]string{"bogus": "1"})
|
|
session.MakeRequest(t, req, http.StatusForbidden)
|
|
}
|