From 57bb1b071e2f6385b3d41ab77cc33d3570a3fe20 Mon Sep 17 00:00:00 2001 From: pilcrowOnPaper Date: Sat, 21 Sep 2024 15:34:30 +0900 Subject: [PATCH] add warning --- pages/webauthn.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pages/webauthn.md b/pages/webauthn.md index b94850b..daad5e6 100644 --- a/pages/webauthn.md +++ b/pages/webauthn.md @@ -307,15 +307,15 @@ const credential = await navigator.credentials.get({ The client data, authenticator data, signature, and credential ID are sent to the server. The challenge, the authenticator, and the client data are first verified. This part is nearly identical to the steps for verifying attestation expect that the client data type should be `webauthn.get`. -Another difference is that the credential portion of the authenticator is not included. - ```go if clientData.Type != "webauthn.get" { return errors.New("invalid type") } ``` -Finally, verify the signature. The signature is of the authenticator data and the SHA-256 hash of the client data JSON. For ECDSA, the signature is ASN.1 DER encoded. +Another difference is that the credential portion of the authenticator is not included. + +Use the credential ID to get the credential's public key. **For 2FA, ensure that the credential belongs to the authenticated user.** Skipping this check will allow malicious actors to entirely skip 2FA. The signature is of the authenticator data and the SHA-256 hash of the client data JSON. For ECDSA, the signature is ASN.1 DER encoded. ```go import (