Repository navigation
verifyRegistrationResponse accepts crossOrigin: true (top-origin check only applied in authentication) #815
kazuru-chidumbwe
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Observed. verifyRegistrationResponse accepts client data with crossOrigin: true when no expected top origin is configured. In 14.0.3 verifyAuthenticationResponse rejects an unexpected top origin; registration does not. 13.3.3 accepts it in both ceremonies.
Spec. WebAuthn Level 3 §7.1 step 10 requires the RP to verify it expects cross-origin use when C.crossOrigin is true; crossOrigin/topOrigin are defined for both ceremonies (§5.8.1).
Ask. Apply the same top-origin check in registration as in authentication.
All reactions