Implement assertion

[duijf]

WIP PR to implement assertion.

Updated Ruud's test fixtures. The tests still fail on actually verifying the signature.

[arianvp]

Maybe we should look at how https://github.com/duo-labs/webauthn/blob/master/protocol/webauthncose/webauthncose.go implements it

[arianvp]

This fucking standard is beyond parody!

The Signature in the cbor value is ASN.1 encoded

signature.

Using the function defined in [RFC8017], the signature is:
Signature = I2OSP(R, n) | I2OSP(S, n)
where n = ceiling(key_length / 8)

https://tools.ietf.org/html/rfc8152#section-8.1

[arianvp]

Sorry this one. https://www.w3.org/TR/webauthn/#signature-attestation-types

The COSE one isn't asn.1 but fixed size. But the one in websauthn is for backwards compatibility reasons. Wow :/

[arianvp]

@duijf I fixed the signature code!

I don't know what else needs to happen in this PR, so I give it back to you

[duijf]

I managed to get this to work 🎉

Also found a bug in our cookie settings while I was at this: we didn't set the cookie path, so we would have separate sessions per URL of our application. I changed this to set all cookies on /

You can test this in your browser by keeping an eye on your devtools while doing:

• Click the "Test authentication" button and see a 401 response.
• Registering a new credential
• Click the "Test authentication" button and see a 200 response.
• Click "Login" and see a 400 bad request (because you're already signed in).
• Clear all cookies in your devtools without refreshing the page.
• Click the "Test authentication" button and see a 401 response.
• Click "Login" and use your Yubikey.
• Click the "Test authentication" button and see a 200 response.

(Admittedly, this is not a convincing demo and bad UX. We can clean that up later, the most important thing is that this works!)

[arianvp]

Cool. Just tried and it works!

How about we add a userName field to the Login form as well; we can then look up the userHandle in the database and do a login even after a refresh

However we can also clean up the "UX" of the demo in a later PR.

[duijf]

How about we add a userName field to the Login form as well; we can then look up the userHandle in the database and do a login even after a refresh

This sounds nice! I would like to wait on #15 to land before we spend time on this though

[duijf]

Rebased and resolved conflicts. Am going to merge this