Method verifyWebAuthnFactor

internal/api/mfa.go:869–987

(w http.ResponseWriter, r *http.Request, params *VerifyFactorParams)

}

func (a *API) verifyWebAuthnFactor(w http.ResponseWriter, r *http.Request, params *VerifyFactorParams) error {
	ctx := r.Context()
	config := a.config
	user := getUser(ctx)
	factor := getFactor(ctx)
	db := a.db.WithContext(ctx)

	var webAuthn *webauthn.WebAuthn
	var credential *webauthn.Credential
	var err error

	switch {
	case params.WebAuthn == nil:
		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "WebAuthn config required")
	case params.WebAuthn.Type != "create" && params.WebAuthn.Type != "request":
		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "WebAuthn type must be create or request")
	case params.WebAuthn.CredentialResponse == nil:
		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "credential_response required")
	default:
		webAuthn, err = a.getWebAuthnMFA()
		if err != nil {
			return err
		}
	}

	challenge, err := a.validateChallenge(r, db, factor, params.ChallengeID)
	if err != nil {
		return err
	}
	webAuthnSession := *challenge.WebAuthnSessionData.SessionData

	var parsedResponse interface{}
	switch params.WebAuthn.Type {
	case "create":
		parsedResponse, err = wbnprotocol.ParseCredentialCreationResponseBody(bytes.NewReader(params.WebAuthn.CredentialResponse))
		if err != nil {
			return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Invalid credential_response")
		}
		credential, err = webAuthn.CreateCredential(user, webAuthnSession, parsedResponse.(*wbnprotocol.ParsedCredentialCreationData))
		if err != nil {
			return err
		}

	case "request":
		parsedResponse, err = wbnprotocol.ParseCredentialRequestResponseBody(bytes.NewReader(params.WebAuthn.CredentialResponse))
		if err != nil {
			return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Invalid credential_response")
		}
		credential, err = webAuthn.ValidateLogin(user, webAuthnSession, parsedResponse.(*wbnprotocol.ParsedCredentialAssertionData))
		if err != nil {
			return apierrors.NewInternalServerError("Failed to validate WebAuthn MFA response").WithInternalError(err)
		}
	}

	// Once the challenge is validated, we consume the challenge
	if err := db.Destroy(challenge); err != nil {
		return apierrors.NewInternalServerError("Database error deleting challenge").WithInternalError(err)
	}