mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
a25d1d77eb
28.0.0 bumped `github.com/go-webauthn/webauthn` from v0.17.4 to v0.18.x. v0.18.0 made the ceremony fail whenever the client returns a client extension output the relying party did not request, unless `Config.ExtensionsUnsolicitedOutputPolicy` says otherwise; the strict behavior is the zero value, so not configuring a policy opts into it (upstream MIGRATION.md §2.4). Every security-key and passkey login from Safari on iOS fails with 403: Client returned the "appid" extension output which was not requested To fix, set `ExtensionsUnsolicitedOutputPolicy: protocol.UnsolicitedOutputPolicyIgnore` in the webauthn config Fixes #39790 --------- Signed-off-by: choksi2212 <choksi2212@users.noreply.github.com> Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: choksi2212 <choksi2212@users.noreply.github.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
28 lines
707 B
Go
28 lines
707 B
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package webauthn
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/modules/setting"
|
|
|
|
"github.com/go-webauthn/webauthn/protocol"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestInit(t *testing.T) {
|
|
setting.AppDomain = "domain"
|
|
setting.AppName = "AppName"
|
|
setting.AppURL = "https://domain/"
|
|
rpOrigin := []string{"https://domain"}
|
|
|
|
Init()
|
|
|
|
assert.Equal(t, setting.AppDomain, WebAuthn.Config.RPID)
|
|
assert.Equal(t, setting.AppName, WebAuthn.Config.RPDisplayName)
|
|
assert.Equal(t, rpOrigin, WebAuthn.Config.RPOrigins)
|
|
assert.Equal(t, protocol.UnsolicitedOutputPolicyIgnore, WebAuthn.Config.ExtensionsUnsolicitedOutputPolicy)
|
|
}
|