Ankur Mhatre
f6dd692177
Fourth Maven project in the repository. Registration and authentication run end to end with no browser and no hardware key: VirtualAuthenticator emits real CBOR attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java drives the live HTTP endpoints with them. Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.
16 lines
537 B
Bash
Executable File
16 lines
537 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# What a phishing attempt looks like from the relying party's side, in both ceremonies.
|
|
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
|
|
start_app "" > /dev/null
|
|
{
|
|
header "Registration from a disallowed origin"
|
|
ceremony wrong-origin
|
|
echo
|
|
echo "--- what the server logged ---"
|
|
grep -A4 -m1 -E 'BadOriginException|InconsistentClientDataTypeException' "$APP_LOG" || tail -5 "$APP_LOG"
|
|
|
|
header "Assertion from a disallowed origin"
|
|
ceremony wrong-origin-login
|
|
} 2>&1 | tee "$OUTPUT_DIR/pk-origin.txt"
|
|
stop_app
|