webauthn

module
Version: v0.3.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 12, 2018 License: MIT

README

webauthn : Web Authentication API in Go

Overview GoDoc Build Status

This project provides a low-level and a high-level API to use the Web Authentication API (WebAuthn).

Demo

Install

go get github.com/koesie10/webauthn

High-level API

The high-level API can be used with the net/http package and simplifies the low-level API. It is located in the webauthn subpackage. It is intended for use with e.g. fetch or XMLHttpRequest JavaScript clients.

First, make sure your user entity implements User. Then, create a new entity implements Authenticator that stores each authenticator the user registers.

Then, either make your existing repository implement AuthenticatorStore or create a new repository.

Finally, you can create the main WebAuthn struct supplying the Config options:

w, err := webauthn.New(&webauthn.Config{
	// A human-readable identifier for the relying party (i.e. your app), intended only for display.
	RelyingPartyName:   "webauthn-demo",
	// Storage for the authenticator.
	AuthenticatorStore: storage,
})		

Then, you can use the methods defined, such as StartRegistration to handle registration and login. Every handler requires a Session, which stores intermediate registration/login data. If you use gorilla/sessions, use webauthn.WrapMap(session.Values). Read the documentation for complete information on what parameters need to be passed and what values are returned.

For example, a handler for finish registration might look like this:

func (r *http.Request, rw http.ResponseWriter) {
	ctx := r.Context()
	user, ok := UserFromContext(ctx)
	if !ok {
		rw.WriteHeader(http.StatusForbidden)
		return
	}

	sess := SessionFromContext(c)

	h.webauthn.FinishRegistration(c.Request(), c.Response(), user, webauthn.WrapMap(sess))
}

A complete demo application using the high-level API which implements all of these interfaces and stores data in memory is available here.

JavaScript example

This class is an example that can be used to handle the registration and login phases. It can be used as follows:

const w = new WebAuthn();

// Registration
w.register().then(() => {
	alert('This authenticator has been registered.');
}).catch(err => {
	console.error(err)
	alert('Failed to register: ' + err);
});

// Login
w.login().then(() => {
	alert('You have been logged in.');
}).catch(err => {
	console.error(err)
	alert('Failed to login: ' + err);
});

Low-level API

The low-level closely resembles the specification and the high-level API should be preferred. However, if you would like to use the low-level API, the main entry points are:

License

MIT.

Directories

Path Synopsis
cose contains utility functions related to COSE keys, Section 7 of [RFC8152].
cose contains utility functions related to COSE keys, Section 7 of [RFC8152].
protocol is a low-level package that closely resembles the WebAuthn specification.
protocol is a low-level package that closely resembles the WebAuthn specification.
webauthn is a high-level package that contains HTTP request handlers which can be used to implement webauthn in any application.
webauthn is a high-level package that contains HTTP request handlers which can be used to implement webauthn in any application.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL