Webauthn RP ID matching too strict
Open
- Dominant language
- C++
- Stars
- 39
- Forks
- 93
- PR merge metrics
- No merged PRs in 30d
Description
As per W3C RP ID specs at https://w3c.github.io/webauthn/#relying-party-identifier
"Given a Relying Party whose origin is https://login.example.com:1337, then the following RP IDs are valid: login.example.com (default) and example.com, but not m.login.example.com and not com."
However, fc does a rpIdHash === sha(clientDataJSON.origin) match which is too strict and does not cover the case where the origin may be login.example.com while the rp id is example.com:
https://github.com/EOSIO/fc/blob/ff56d25e587f8131cfde06f1eb61baa899bc8a89/src/crypto/elliptic_webauthn.cpp#L213
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.