Ankur Mhatre
f6dd692177
Fourth Maven project in the repository. Registration and authentication run end to end with no browser and no hardware key: VirtualAuthenticator emits real CBOR attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java drives the live HTTP endpoints with them. Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.
16 lines
778 B
Plaintext
16 lines
778 B
Plaintext
==============================================================================
|
|
Bootstrapping - registering a passkey requires an existing authenticated session
|
|
==============================================================================
|
|
|
|
=== Asking for registration options with nobody logged in ===
|
|
|
|
$ POST /webauthn/register/options (anonymous)
|
|
HTTP 400
|
|
(empty body)
|
|
|
|
=== A one-time token for a username that does not exist ===
|
|
POST /ott/generate -> HTTP 302, Location: http://localhost:8080/login/ott
|
|
a token was still generated and delivered: d75e51fe-cbde-4add-8d70-231fc6ca490f
|
|
the response is byte-for-byte what a real username produces - no enumeration oracle
|
|
POST /login/ott -> HTTP 302, Location: http://localhost:8080/login?error (the failure lands here instead)
|