lundberg/porchlight
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): make WebAuthn user verification configurable

Browse source 
User verification was hardcoded to PREFERRED. Add a webauthn_user_verification
setting (default "preferred") wired into WebAuthnService for both registration
and authentication, so identity-provider deployments can require it.

Refs: porchlight-is8

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Johan Lundberg 2026-06-05 13:48:27 +02:00
parent baef5e0e2e
commit 0f04a7daf9
No known key found for this signature in database
GPG key ID: A6C152738D03C7D1
4 changed files with 30 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tests/test_authn/test_webauthn.py
View file

@ -17,6 +17,7 @@ from fido2.webauthn import (
PublicKeyCredentialDescriptor,
PublicKeyCredentialType,
RegistrationResponse,
UserVerificationRequirement,
)
from porchlight.authn.webauthn import WebAuthnService
@ -194,6 +195,19 @@ def test_begin_authentication_prefers_user_verification() -> None:
assert pub_key["userVerification"] == "preferred"
def test_user_verification_is_configurable() -> None:
service = WebAuthnService(
rp_id=RP_ID,
rp_name=RP_NAME,
origin=ORIGIN,
user_verification=UserVerificationRequirement.REQUIRED,
)
reg, _ = service.begin_registration(user_id=b"user-123", username="alice")
assert reg["publicKey"]["authenticatorSelection"]["userVerification"] == "required"
auth, _ = service.begin_authentication()
assert auth["publicKey"]["userVerification"] == "required"
def test_begin_authentication_returns_options_and_state() -> None:
service = _make_service()
_, cred_id, _attested = _generate_credential()