Changeset 6769

Timestamp:

Jun 9, 2022, 9:13:39 AM (16 months ago)

Author:

Nicklas Nordborg

Message:

References #1396: Implement an login extension for WebAuthn?

Using POST request instead of GET when starting the login to avoid that the password is part of the URL that may be cached or logged.

Location:

extensions/net.sf.basedb.webauthn/trunk

Files:

• resources/webauthn-login.js (modified) (2 diffs)
• src/net/sf/basedb/webauthn/WebAuthnServlet.java (modified) (3 diffs)

extensions/net.sf.basedb.webauthn/trunk/resources/webauthn-login.js

@@ -36 +36 @@
     var frm = document.forms['login'];
     var login = frm.login.value;
-    var pwd = frm.password.value;
+    var password = frm.password.value;
     var home = Data.get(frm, 'home');
     var url = home+'/WebAuthn.servlet?ID='+App.getSessionId();
     url += '&cmd=StartWebAuthnLogin';
-    url += '&login='+encodeURIComponent(login);
-    url += '&password='+encodeURIComponent(pwd);
     
     try
@@ -47 +45 @@
       if (debug) App.debug('AJAX request: '+url);
       var request = Ajax.getXmlHttpRequest();
+      request.open("POST", url, true);  
       Ajax.setReadyStateHandler(request, wa.webAuthnLoginRequestRecieved, wa.webAuthnLoginRequestRecieved);
-      request.open("GET", url, true); 
-      request.send(null);
+      request.setRequestHeader("Content-Type", "application/json; charset=UTF-8");
+      request.send(JSON.stringify({'login':login, 'password': password}));
     }
     catch (e)

extensions/net.sf.basedb.webauthn/trunk/src/net/sf/basedb/webauthn/WebAuthnServlet.java

@@ -68 +68 @@
         json.put("registrationRequest", (JSONObject)new JSONParser().parse(registrationOptions.toCredentialsCreateJson()));
       }
-      else if ("StartWebAuthnLogin".equals(cmd))
-      {
-        String login = StringUtil.setNotNullString(Values.getStringOrNull(req.getParameter("login")), "User.Login", User.MAX_LOGIN_LENGTH);
-        String password = StringUtil.setNotNullString(Values.getStringOrNull(req.getParameter("password")), "User.Password", Integer.MAX_VALUE);
-        final SessionControl sc = Application.getSessionControl(ID, "net.sf.basedb.clients.web", req.getRemoteAddr(), false);
-        
-        LoginRequest lr = new LoginRequest(login, password);
-        lr.setVerifyOnly(true);
-        lr.setAttribute("login-form", "net.sf.basedb.webauthn.pre-login");
-        lr.setAttribute("serverName", req.getServerName());
-        try
-        {
-          sc.login(lr);
-        }
-        catch (AssertionRequestException ex)
-        {
-          // This exception is expected and contains the information we need to send back to the browser
-          json.put("assertionRequest", ex.getJson());
-        }
-      }
     }
     catch (Throwable t)
@@ -116 +96 @@
     try
     {
-      final SessionControl sc = Application.getSessionControl(ID, "net.sf.basedb.clients.web", req.getRemoteAddr(), true);
-
       if ("FinalizeWebAuthnRegister".equals(cmd))
       {
+        final SessionControl sc = Application.getSessionControl(ID, "net.sf.basedb.clients.web", req.getRemoteAddr(), true);
         String postData = JsonUtil.parseRequestAsString(req);
         
@@ -133 +112 @@
         json.put("message", "WebAuthn registration completed!");
       }
+      else if ("StartWebAuthnLogin".equals(cmd))
+      {
+        final SessionControl sc = Application.getSessionControl(ID, "net.sf.basedb.clients.web", req.getRemoteAddr(), false);
+        JSONObject jsonReq = JsonUtil.parseRequestAsJson(req);
+        
+        String login = StringUtil.setNotNullString((String)jsonReq.get("login"), "Login", User.MAX_LOGIN_LENGTH);
+        String password = StringUtil.setNotNullString((String)jsonReq.get("password"), "Password", Integer.MAX_VALUE);
+        
+        LoginRequest lr = new LoginRequest(login, password);
+        lr.setVerifyOnly(true);
+        lr.setAttribute("login-form", "net.sf.basedb.webauthn.pre-login");
+        lr.setAttribute("serverName", req.getServerName());
+        try
+        {
+          // This login request should end up being handled by PreLoginAuthenticationManager
+          // The AssertionRequestException is expected for normal operations
+          sc.login(lr);
+          throw new IllegalStateException("An AssertionRequest could not be created. "
+              + "Please try later or contact a server administrator.");
+        }
+        catch (AssertionRequestException ex)
+        {
+          // This exception is expected and contains the information we need to send back to the browser
+          json.put("assertionRequest", ex.getJson());
+        }
+      }
+
     }
     catch (Throwable t)