diff --git a/packages/server/src/registration/verifications/verifyAttestationAndroidSafetyNet.ts b/packages/server/src/registration/verifications/verifyAttestationAndroidSafetyNet.ts index 29a20f1a..b06b980e 100644 --- a/packages/server/src/registration/verifications/verifyAttestationAndroidSafetyNet.ts +++ b/packages/server/src/registration/verifications/verifyAttestationAndroidSafetyNet.ts @@ -23,6 +23,7 @@ export async function verifyAttestationAndroidSafetyNet( rootCertificates, verifyTimestampMS = true, credentialPublicKey, + attestationSafetyNetEnforceCTSCheck, } = options; const alg = attStmt.get('alg'); const response = attStmt.get('response'); @@ -82,7 +83,7 @@ export async function verifyAttestationAndroidSafetyNet( throw new Error('Could not verify payload nonce (SafetyNet)'); } - if (!ctsProfileMatch) { + if (attestationSafetyNetEnforceCTSCheck && !ctsProfileMatch) { throw new Error('Could not verify device integrity (SafetyNet)'); } /** diff --git a/packages/server/src/registration/verifyRegistrationResponse.test.ts b/packages/server/src/registration/verifyRegistrationResponse.test.ts index efb38230..80803b30 100644 --- a/packages/server/src/registration/verifyRegistrationResponse.test.ts +++ b/packages/server/src/registration/verifyRegistrationResponse.test.ts @@ -1047,6 +1047,66 @@ Deno.test('should verify Packed attestation with RSA-PSS SHA-384 public key', as assert(verification.verified); }); +Deno.test('should enforce CTS check by default', async () => { + const mockDate = new FakeTime(new Date('2025-06-09T20:40:42.989Z')); + + await assertRejects(async () => { + await verifyRegistrationResponse({ + response: { + id: + 'AS_TChPtwkqgPwDxkkF39yjfaPJtKiwMGIY69EV7udG2xaP8hYnjJsPS7VPnUA2xaUZc7dHot5WwYRRoavu7Ais', + rawId: + 'AS_TChPtwkqgPwDxkkF39yjfaPJtKiwMGIY69EV7udG2xaP8hYnjJsPS7VPnUA2xaUZc7dHot5WwYRRoavu7Ais', + response: { + clientDataJSON: + 'eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiWjI5dloyeGxMVzloZFhSb01ud3hNREUyTVRFME1EUTVOREk1T0RRek56YzROak0iLCJvcmlnaW4iOiJodHRwczpcL1wvbG9naW4uYXV0aHJlc3MuaW8iLCJhbmRyb2lkUGFja2FnZU5hbWUiOiJjb20uYW5kcm9pZC5jaHJvbWUifQ', + attestationObject: + 'o2NmbXRxYW5kcm9pZC1zYWZldHluZXRnYXR0U3RtdKJjdmVyaTI1MjAzNzAyOWhyZXNwb25zZVkf_WV5SmhiR2NpT2lKU1V6STFOaUlzSW5nMVl5STZXeUpOU1VsR1RXcERRMEpDY1dkQmQwbENRV2RKVWtGTEswZFhaRGR0ZFRocE1rTjFNbGs0Tmk5dk1DOVZkMFJSV1VwTGIxcEphSFpqVGtGUlJVeENVVUYzVDNwRlRFMUJhMGRCTVZWRlFtaE5RMVpXVFhoSWFrRmpRbWRPVmtKQmIxUkdWV1IyWWpKa2MxcFRRbFZqYmxaNlpFTkNWRnBZU2pKaFYwNXNZM3BGVFUxQmIwZEJNVlZGUVhoTlJGWXhTVEJOUWpSWVJGUkpNVTFFVVhsUFZFRTBUVVJCTUU1R2IxaEVWRWt4VFVSamVVOUVRVFJOUkVFd1RURnZkMGhVUldKTlFtdEhRVEZWUlVGNFRWTlpXRkl3V2xoT01FeHRSblZhU0VwMllWZFJkVmt5T1hSTlNVbENTV3BCVGtKbmEzRm9hMmxIT1hjd1FrRlJSVVpCUVU5RFFWRTRRVTFKU1VKRFowdERRVkZGUVRGVFJrcE1aR0Y0TTNVcllYRmxaVkJPWWt4NFlqRjJUelEwTWxGRFN5OUROekZCUW5GcWVrNVNWVlp3ZUM5eFRIZ3pSMGhGZDAxTFpVdzNjVVpHVG1WTmVVcExSRW8xU0ZCVk5qQm5NRWw0Tm5BM1FtbFBkbXRFVlhvck1sRnFWalJ3V2pWMU5rMDRVekJtVGpkbGJuaFJjSGhJUWtrdkx6VnhNMUUxY2tGVk1UQkRZMWhZZHpoYVpYVlZRa3BTUW5kMVVscDJiVE0xYlZsWFJsVnZkRmQyWVVSRVNYcGFlWFV6TVdST1MyeExkREJUWWtWMVJubGpaVmRhT0dKaGIzUkNkVWRtYUZveE1HeElSMHRtV0VORFVqWXpkVnBOU0Uxa2NHVjVWa280ZHpkemIxZzJkMnRoZFZwd1lsRTFSMWs0VkRKUWJFbFBlRWxsV2tVeWNWcGtha3RLV2paVFdrOVhTalo0V1VNelduUmFOM2hhUldzMmFEbHlOSEZ0VlN0VVlXSkVOM00zVEhGSFZIWTRTRlF4YjJNNWQyRTRLMmhrTDNNNWRHZFpRbTB4UlROaWJIWTRiVFZZUlhrdlNHbFhTbEpJVVVsRVFWRkJRbTgwU1VOVVZFTkRRV3RyZDBSbldVUldVakJRUVZGSUwwSkJVVVJCWjFkblRVSk5SMEV4VldSS1VWRk5UVUZ2UjBORGMwZEJVVlZHUW5kTlFrMUJkMGRCTVZWa1JYZEZRaTkzVVVOTlFVRjNTRkZaUkZaU01FOUNRbGxGUmtoYU1HWm5OVXhVUTNSYU9HZEhkRmRzZDBkTU1sY3hSbmhRUzAxQ09FZEJNVlZrU1hkUldVMUNZVUZHU25aSlJXSjNPWEZxWVRWTldYaFBhakJVVmxaNlNYWjNPRUpvVFVZMFIwTkRjMGRCVVZWR1FuZEZRa0pHU1hkVlJFRnVRbWRuY2tKblJVWkNVV04zUVZsWlltRklVakJqUkc5MlRESTRkV05IZEhCTWJXUjJZakpqZG1ONU9UTmphbEYyWTJwU1drMURWVWREUTNOSFFWRlZSa0o2UVVOb2FHeHZaRWhTZDA5cE9IWmhVelYzWVRKcmRWb3lPWFphZVRrelkycFJkVmt6U2pCTlFqQkhRVEZWWkVWUlVWZE5RbE5EUlcxR01HUkhWbnBrUXpWb1ltMVNlV0l5Ykd0TWJVNTJZbFJCVkVKblRsWklVMEZGUkVSQlMwMUJaMGRDYldWQ1JFRkZRMEZVUVRKQ1owNVdTRkk0UlV4NlFYUk5RM1ZuUzJGQmJtaHBWbTlrU0ZKM1QyazRkbGw1TlhkaE1tdDFXakk1ZGxwNU9UTmphbEYyV1d0V1UxcHJNVWxSVlZrMVZEQlZkVmt6U25OTlNVbENRbWRaUzB0M1dVSkNRVWhYWlZGSlJVRm5VMEk1ZDFOQ09VRkVlVUZJWTBFelpIcExUa3BZV0RSU1dVWTFOVlY1SzNObFppdEVNR05WVGk5aVFVUnZWVVZ1V1V0TVMzazNlVU52UVVGQlIxZG5UV05PUW5kQlFVSkJUVUZUUkVKSFFXbEZRVGR4VGk5U1ExQk5ia3RLUkZCclIzbExkRUZtWjJVd1ExUmxkV2xHU1ZVM04yMDVLM2MyVTJJMGJqQkRTVkZEYjBZME0zRTNTV052U0hZMU1tZG5TR1l4VG01eE0zWnhVM1IzUWs4MlpHOHZkRkpsTkVGNWExTnRkMEl6UVUxNk4wUXljVVpqVVd4c0wzQlhZbFU0TjNCemJuZHBObGxXWTBSYVpVNTBjV3dyVmsxRUsxUkJNbmRCUVVGQ2JHOUVTRVZQT0VGQlFWRkVRVVZuZDFKblNXaEJTMnd5VFV0YWNVVlNjV1pNWkVwaEt6bERNemRXU0dWTk5rWjFSRlIyVmpkNGRHeDFTR2hWVTBkdFpFRnBSVUZ5VlRVMGRtdFVUR3A2VDI0NEwyODNVVkkwZUN0ek9FWmlkV1JMV1M5a01VUXZiekI0YkZsNGJHVTRkMFJSV1VwTGIxcEphSFpqVGtGUlJVeENVVUZFWjJkRlFrRktOMDFwVVd4M2JqaHJiV1ppWVVKM1NUTmtWakI1Vm5RMWF6WkRMMjlIZUVWaldYQlpTRUZIU2pJMU5saG9lSFZtYTBoaFkzZGFVRkJ4VVdZNU5Fc3dWRWRRVkVKMGJGRmlRVFJoU0doME4wbExPVWRHYTBOdk5IbHVSbHBKTVN0NWNXUjVXbmh6ZW1aU1pVSTFRVXhJTTNoa2NqQnFMMmRhVG5OQlpDdFJSakUwUTBoUGJsWTVOV1pOVVc1dVNXaDFieXQxWWtoVFpVMTNlREJ0ZVcxdGJWUldRVGs0Wm5rMmRYaDBZWFZaVUZocVozZ3JPVGxQVm05U2FYaEtOWGg0VlVkVlRGcEpjaTlHZVRodE1tZEhRMGR0UlU5alMwcExUbmQxUWprMmNYRjJLMVpaZFM5QlZuUTJUMHh0V1RONGIydEdLMmgzWkVZMmNURXZWRkZwYTJGeVFuUjBWVmxSV25Bd1QwZDVhM1pJTVZGelIwMDNSRU12TmpORU0weEtRMFIwV1U0eUsxa3ZkRmdyWm14T2IzazVibXByTTNSSE1GcEplVzB4ZUhKNE1FcDVSSFF5VVRCb1dYUnFTRVpoTDI4M2RrVTlJaXdpVFVsSlJrTjZRME5CZGs5blFYZEpRa0ZuU1ZGbUwwRkdkRTV3TVhWSGNHRjRhQzlyVFVoalZIcFVRVTVDWjJ0eGFHdHBSemwzTUVKQlVYTkdRVVJDU0UxUmMzZERVVmxFVmxGUlIwVjNTbFpWZWtWcFRVTkJSMEV4VlVWRGFFMWFVakk1ZGxveWVHeEpSbEo1WkZoT01FbEdUbXhqYmxwd1dUSldla2xGZUUxUmVrVlZUVUpKUjBFeFZVVkJlRTFNVWpGU1ZFbEdTblppTTFGblZXcEZkMGhvWTA1TmFrMTRUV3BGZWsxRWEzZE5SRUYzVjJoalRrMXFhM2ROYWtsM1RWUlJkMDFFUVhkWGFrRTNUVkZ6ZDBOUldVUldVVkZIUlhkS1ZsVjZSV1ZOUW5kSFFURlZSVU5vVFZaU01qbDJXako0YkVsR1VubGtXRTR3U1VaT2JHTnVXbkJaTWxaNlRWRjNkME5uV1VSV1VWRkVSWGRPV0ZWcVVYZG5aMFZwVFVFd1IwTlRjVWRUU1dJelJGRkZRa0ZSVlVGQk5FbENSSGRCZDJkblJVdEJiMGxDUVZGRGRsUnNSeTk2YkVOck5qUTBPV3RoVnk5RVEyOXBjVzl3TUhCSmQzbGhUamhMVVVkaWMxWXlNSE55TUdJME1qbEtjbEpOVVV4S1ZDODNjMGxTVEhOWVpISldZMEUxTnpjMVZqbFlVUzlHYkZaUVZYTjVSbEZoVjBoRmVHZGhVV0ZtTWxCYWVFNVdhMWxtVkRsVFZEVTNZVGxWWWxZclRsUnNaR051YlhoMmIyOU1iWEJvZHk5VVJuWnNibkJ4TW5KTk1UVjViRWhwY1Roc1IzRm5VWEJTT1M4MlFVeDFiMnh0VjBSV1QxQkdSV2RCYkZSa09WRnZSVmM1WjB4TmRVY3piRTh6TVd4MGMyVnVXbGRVTVd4RFVWTXlVbEpXVTNoWWFqZGpVak15YkZoblUwVnphekZhZWpVM1pWSnNaME5tZVdaQmRsVktWWFJOZERrNE1uTnZUbEl5WkhwUFZrOUxhamw2YkdsbFJuSmlaR1pDV21oNFdraFJiamRKU25WSFkyTmthVXB1UzFSVVpXSkNhbmhOYUZWalZVaHJOako1YkU4M1oyVk1kR0l6U2sxVlltSnVkbE5aUkRKVlFXTnNaM3B5ZDJ4QlowMUNRVUZIYW1kbU5IZG5abk4zUkdkWlJGWlNNRkJCVVVndlFrRlJSRUZuUjBkTlFqQkhRVEZWWkVwUlVWZE5RbEZIUTBOelIwRlJWVVpDZDAxQ1FtZG5ja0puUlVaQ1VXTkVRV3BCVTBKblRsWklVazFDUVdZNFJVTkVRVWRCVVVndlFXZEZRVTFDTUVkQk1WVmtSR2RSVjBKQ1UySjVRa2M0VUdGdk1uVlVSMDFVYnpsRk1WWmplVXc0VUVGWlZFRm1RbWRPVmtoVFRVVkhSRUZYWjBKVWEzSjVjMjFqVW05eVUwTmxSa3d4U20xTVR5OTNhVkpPZUZCcVFUQkNaMmR5UW1kRlJrSlJZMEpCVVZGdlRVTlpkMHBCV1VsTGQxbENRbEZWU0UxQlMwZEhSMmd3WkVoQk5reDVPWEJNYmtKeVlWTTFibUl5T1c1TU0wbDRURzFPZVdSRVFYSkNaMDVXU0ZJNFJVcEVRV2xOUTBOblNIRkJZMmhvY0c5a1NGSjNUMms0ZGxsNU5YZGhNbXQxV2pJNWRscDVPWGxNTTBsNFRHMU9lV0pFUVZSQ1owNVdTRk5CUlVSRVFVdE5RV2RIUW0xbFFrUkJSVU5CVkVGT1FtZHJjV2hyYVVjNWR6QkNRVkZ6UmtGQlQwTkJaMFZCYURKdVJEbFhSRFZ6YTNwVlRFRjRiVWxrZEhoV1dscEdPQzgxZDNRMWFXWkpUVlZCVlZKT1ZuZGFZMHc1ZFhWUGRuSk9WRGMxY0Zab2VUTlpOR1J4T1ZCMFFrUjVTVzFuVkdOSldISnhjRGhGVEd4UlNHSk5SMUl5YjI1RE1YazFhRkpwYjFJelIwY3hTamh4UjBKbE0wSXhSRkY2YmpCeGJ6VkhhM0o0TkdscGFpOWtOblI1YjBkNFpucGtRWFowVUZKUksyczJVR0ZZWVRoTVYyUm9hbkJUTHk5WFJtZFBOazFZVDB0bE5uRlVhV05XYldvMk5GaFpkMnB2UkZGWlRuVlpTSFJEVjFCR2NsYzRhVzFEWkROU01UVklLek5MYkVOdVRUZEdkbEY1WkU1eU1EUk1VRlYwTDB4WlRUaEhXa2hDU25sVmNURnZXSFpGTlZKTFYydHZkekZRZEVod2RXMHpPVGgxUjNsV2VtWXJkblVyTURGcEwyMWtSRkZ3YzJJdlNTOVFVVlk1UWtGS2FXNDVSVEpqWmxsTWJFRnpUbXc1Vm1GVmIxVnBaemx4ZFd4VEsycHJibVJvZEU5VFVXTlhkSGMyTWxsTWRVZHZMM2xKT1dOR05GVlpOSEU1YkZkblRrODNURGxKVmxaSVVXODVORzlEY2t3eFoxSk5TMEZPZEVacllXTk1SRVZEZDBGMVJsTkxkblZvWVRkRVlXNVpOMmhhTjFseFJqWklhMDVzU25wVVFUWlpPVlZTVG5FNVRYaHhTbWhOWlZSa2EyVm1laXR6TVVGa0wxRlpNR1V5VFVoSFoySkZLMjlPWkRSaGQxUmtja1Y0VXpKQ01rVndOM2RqVTJreGIwRXpOSEJKWVVwblVYVlhkVGhHY205alEzTjZjM0ZqSzI5S1YxUnlkekpXVVdkbE9YaG5WVnBWVFZwTVVsZGlSalJxTTBaTFVITldWbWRXS3pkbk9UVlNUa1ZxUjJoRE1VMDRUR0Z6T0hkM05WUXJkVUpRVFV4elUxRnJNa0pTU0dOM1pubEVVakl3T1RKS1JteGtSM1ZCT0UxVlFYSkhUaTl1U0ZSRVpsZGhXVXhKVUVOVmFIZENhSEJaVDJwTGJtazBaVkJNY21Ga2NUZEJSekpSYjBkV2MzcGFkMmRLWlhGTVdFcENaaXRKTm01NWVrWmtNbU0xVDFoTlJ6WTFUbU05SWl3aVRVbEpSbGxxUTBOQ1JYRm5RWGRKUWtGblNWRmtOekJPWWs1ek1pdFNjbkZKVVM5Rk9FWnFWRVJVUVU1Q1oydHhhR3RwUnpsM01FSkJVWE5HUVVSQ1dFMVJjM2REVVZsRVZsRlJSMFYzU2tOU1ZFVmFUVUpqUjBFeFZVVkRhRTFSVWpKNGRsbHRSbk5WTW14dVltbENkV1JwTVhwWlZFVlJUVUUwUjBFeFZVVkRlRTFJVlcwNWRtUkRRa1JSVkVWaVRVSnJSMEV4VlVWQmVFMVRVako0ZGxsdFJuTlZNbXh1WW1sQ1UySXlPVEJKUlU1Q1RVSTBXRVJVU1hkTlJGbDRUMVJCZDAxRVFUQk5iRzlZUkZSSk5FMUVSWGxQUkVGM1RVUkJNRTFzYjNkU2VrVk1UVUZyUjBFeFZVVkNhRTFEVmxaTmVFbHFRV2RDWjA1V1FrRnZWRWRWWkhaaU1tUnpXbE5DVldOdVZucGtRMEpVV2xoS01tRlhUbXhqZVVKTlZFVk5lRVpFUVZOQ1owNVdRa0ZOVkVNd1pGVlZlVUpUWWpJNU1FbEdTWGhOU1VsRFNXcEJUa0puYTNGb2EybEhPWGN3UWtGUlJVWkJRVTlEUVdjNFFVMUpTVU5EWjB0RFFXZEZRWFJvUlVOcGVEZHFiMWhsWWs4NWVTOXNSRFl6YkdGa1FWQkxTRGxuZG13NVRXZGhRMk5tWWpKcVNDODNOazUxT0dGcE5saHNOazlOVXk5cmNqbHlTRFY2YjFGa2MyWnVSbXc1TjNaMVprdHFObUozVTJsV05tNXhiRXR5SzBOTmJuazJVM2h1UjFCaU1UVnNLemhCY0dVMk1tbHRPVTFhWVZKM01VNUZSRkJxVkhKRlZHODRaMWxpUlhaekwwRnRVVE0xTVd0TFUxVnFRalpITURCcU1IVlpUMFJRTUdkdFNIVTRNVWs0UlRORGQyNXhTV2x5ZFRaNk1XdGFNWEVyVUhOQlpYZHVha2g0WjNOSVFUTjVObTFpVjNkYVJISllXV1pwV1dGU1VVMDVjMGh0YTJ4RGFYUkVNemh0TldGblNTOXdZbTlRUjJsVlZTczJSRTl2WjNKR1dsbEtjM1ZDTm1wRE5URXhjSHB5Y0RGYWEybzFXbEJoU3pRNWJEaExSV280UXpoUlRVRk1XRXd6TW1nM1RURmlTM2RaVlVnclJUUkZlazVyZEUxbk5sUlBPRlZ3YlhaTmNsVndjM2xWY1hSRmFqVmpkVWhMV2xCbWJXZG9RMDQyU2pORGFXOXFOazlIWVVzdlIxQTFRV1pzTkM5WWRHTmtMM0F5YUM5eWN6TTNSVTlsV2xaWWRFd3diVGM1V1VJd1pYTlhRM0oxVDBNM1dFWjRXWEJXY1RsUGN6WndSa3hMWTNkYWNFUkpiRlJwY25oYVZWUlJRWE0yY1hwcmJUQTJjRGs0WnpkQ1FXVXJaRVJ4Tm1SemJ6UTVPV2xaU0RaVVMxZ3ZNVmszUkhwcmRtZDBaR2w2YW10WVVHUnpSSFJSUTNZNVZYY3JkM0E1VlRkRVlrZExiMmRRWlUxaE0wMWtLM0IyWlhvM1Z6TTFSV2xGZFdFckszUm5lUzlDUW1wR1JrWjVNMnd6VjBad1R6bExWMmQ2TjNwd2JUZEJaVXRLZERoVU1URmtiR1ZEWm1WWWEydFZRVXRKUVdZMWNXOUpZbUZ3YzFwWGQzQmlhMDVHYUVoaGVESjRTVkJGUkdkbVp6RmhlbFpaT0RCYVkwWjFZM1JNTjFSc1RHNU5VUzh3YkZWVVltbFRkekZ1U0RZNVRVYzJlazh3WWpsbU5rSlJaR2RCYlVRd05ubExOVFp0UkdOWlFscFZRMEYzUlVGQllVOURRVlJuZDJkblJUQk5RVFJIUVRGVlpFUjNSVUl2ZDFGRlFYZEpRbWhxUVZCQ1owNVdTRkpOUWtGbU9FVkNWRUZFUVZGSUwwMUNNRWRCTVZWa1JHZFJWMEpDVkd0eWVYTnRZMUp2Y2xORFpVWk1NVXB0VEU4dmQybFNUbmhRYWtGbVFtZE9Wa2hUVFVWSFJFRlhaMEpTWjJVeVdXRlNVVEpZZVc5c1VVd3pNRVY2VkZOdkx5OTZPVk42UW1kQ1oyZHlRbWRGUmtKUlkwSkJVVkpWVFVaSmQwcFJXVWxMZDFsQ1FsRlZTRTFCUjBkSFYyZ3daRWhCTmt4NU9YWlpNMDUzVEc1Q2NtRlROVzVpTWpsdVRESmtlbU5xUlhkTFVWbEpTM2RaUWtKUlZVaE5RVXRIU0Zkb01HUklRVFpNZVRsM1lUSnJkVm95T1haYWVUbHVZek5KZUV3eVpIcGpha1YxV1ROS01FMUVTVWRCTVZWa1NIZFJjazFEYTNkS05rRnNiME5QUjBsWGFEQmtTRUUyVEhrNWFtTnRkM1ZqUjNSd1RHMWtkbUl5WTNaYU0wNTVUVk01Ym1NelNYaE1iVTU1WWtSQk4wSm5UbFpJVTBGRlRrUkJlVTFCWjBkQ2JXVkNSRUZGUTBGVVFVbENaMXB1WjFGM1FrRm5TWGRFVVZsTVMzZFpRa0pCU0ZkbFVVbEdRWGRKZDBSUldVeExkMWxDUWtGSVYyVlJTVVpCZDAxM1JGRlpTa3R2V2tsb2RtTk9RVkZGVEVKUlFVUm5aMFZDUVVSVGEwaHlSVzl2T1VNd1pHaGxiVTFZYjJnMlpFWlRVSE5xWW1SQ1drSnBUR2M1VGxJemREVlFLMVEwVm5obWNUZDJjV1pOTDJJMVFUTlNhVEZtZVVwdE9XSjJhR1JIWVVwUk0ySXlkRFo1VFVGWlRpOXZiRlZoZW5OaFRDdDVlVVZ1T1Zkd2NrdEJVMDl6YUVsQmNrRnZlVnBzSzNSS1lXOTRNVEU0Wm1WemMyMVliakZvU1ZaM05ERnZaVkZoTVhZeGRtYzBSblkzTkhwUWJEWXZRV2hUY25jNVZUVndRMXBGZERSWGFUUjNVM1I2Tm1SVVdpOURURUZPZURoTVdtZ3hTamRSU2xacU1tWm9UWFJtVkVweU9YYzBlak13V2pJd09XWlBWVEJwVDAxNUszRmtkVUp0Y0haMldYVlNOMmhhVERaRWRYQnplbVp1ZHpCVGEyWjBhSE14T0dSSE9WcExZalU1VldoMmJXRlRSMXBTVm1KT1VYQnpaek5DV214MmFXUXdiRWxMVHpKa01YaHZlbU5zVDNwbmFsaFFXVzkyU2twSmRXeDBlbXROZFRNMGNWRmlPVk42TDNscGJISmlRMmRxT0QwaVhYMC5leUp1YjI1alpTSTZJblpvUmxadE5UbG9NR1JCWVZwNWJVTlZVMnBPZGtJNWJFdHZPSGRVV2t0REsybDVWbWhYZW5kYUwwazlJaXdpZEdsdFpYTjBZVzF3VFhNaU9qRTNORGsxTURFMk5ESTVPRGtzSW1Gd2ExQmhZMnRoWjJWT1lXMWxJam9pWTI5dExtZHZiMmRzWlM1aGJtUnliMmxrTG1kdGN5SXNJbUZ3YTBScFoyVnpkRk5vWVRJMU5pSTZJazlyU2tscWVHeDBhbVpYY1hsMEwwYzVTamRrTVZkblREUjBVUzg0WlRoSlNITTJja1UzWTNGWlkzYzlJaXdpWTNSelVISnZabWxzWlUxaGRHTm9JanBtWVd4elpTd2lZWEJyUTJWeWRHbG1hV05oZEdWRWFXZGxjM1JUYUdFeU5UWWlPbHNpT0ZBeGMxY3dSVkJLWTNOc2R6ZFZlbEp6YVZoTU5qUjNLMDgxTUVWa0sxSkNTVU4wWVhreFp6STBUVDBpWFN3aVltRnphV05KYm5SbFozSnBkSGtpT25SeWRXVXNJbVYyWVd4MVlYUnBiMjVVZVhCbElqb2lRa0ZUU1VNaUxDSmtaWEJ5WldOaGRHbHZia2x1Wm05eWJXRjBhVzl1SWpvaVZHaGxJRk5oWm1WMGVVNWxkQ0JCZEhSbGMzUmhkR2x2YmlCQlVFa2dhWE1nWkdWd2NtVmpZWFJsWkM0Z1NYUWdhWE1nY21WamIyMXRaVzVrWldRZ2RHOGdkWE5sSUhSb1pTQlFiR0Y1SUVsdWRHVm5jbWwwZVNCQlVFazZJR2gwZEhCek9pOHZaeTVqYnk5d2JHRjVMM05oWm1WMGVXNWxkQzEwYVcxbGJHbHVaUzRpZlEuUnpfZklvRjM3SE5CV05Db2NtckdxLXpsVDMtbUZJZkZvand5YUxiWXJ4dVpwcldxZ0RmNFo4SDBvMVY1WllmcWdXckw2bHNkVVlnZkxmTGRrRjFTQUhiT1U1cEVhYlQzVzdNRUdLLVBiNkZsRlg4NWpMYllSNmVSY3BFV2lVeTVvci1FMVhNSTIwand1Qk10UkJOVnVuV2JqV2gtVkJwWjZTcWRfZURfN3hiSnd0NFdXNW5kZDdZRHB1U3FETThiVldFRHRMOF9yTjRacUhndzJ1ZDI5NUswNHlaTmVTNkdKb0JDdFNzYVAyTjhRdmIwcXl3UlFlWWd6Vi1pVDlkREpnSnVfS1ExWWxmN0N3Nm9nOG56b3l5c1pvMFZXc3BnUnV2eUFFQTFjVFhVSXhISC1nQTVvRWtsTlZJbmtudHNoZWlBc1AtTlFhR25ITUVRVkhYMlNnaGF1dGhEYXRhWMVohwRhK0KVlcdgFyyI6dEhDIutzOO6c9Ae1qAfEXAiQkUAAAAAuT_ZYfLmRi-xIoIAIkfeeABBAS_TChPtwkqgPwDxkkF39yjfaPJtKiwMGIY69EV7udG2xaP8hYnjJsPS7VPnUA2xaUZc7dHot5WwYRRoavu7AiulAQIDJiABIVgg2nChB8Re-aOqUtqbEDUD6BE18yvs5eixZ5gOA5O3Q14iWCDf6BSjMgCAznWaVDQsxx7PdxJFvRwEqqUqA4D7EmNQWQ', + }, + clientExtensionResults: {}, + type: 'public-key', + }, + expectedChallenge: 'Z29vZ2xlLW9hdXRoMnwxMDE2MTE0MDQ5NDI5ODQzNzc4NjM', + expectedOrigin: 'https://login.authress.io', + expectedRPID: 'authress.io', + requireUserVerification: false, + requireUserPresence: false, + attestationSafetyNetEnforceCTSCheck: undefined, // <---- Intentionally undefined + }); + }, 'should reject on bad ctsProfileMatch'); + + mockDate.restore(); +}); + +Deno.test('should skip CTS check when enforcement option is false', async () => { + const mockDate = new FakeTime(new Date('2025-06-09T20:40:42.989Z')); + + const verification = await verifyRegistrationResponse({ + response: { + id: 'AS_TChPtwkqgPwDxkkF39yjfaPJtKiwMGIY69EV7udG2xaP8hYnjJsPS7VPnUA2xaUZc7dHot5WwYRRoavu7Ais', + rawId: + 'AS_TChPtwkqgPwDxkkF39yjfaPJtKiwMGIY69EV7udG2xaP8hYnjJsPS7VPnUA2xaUZc7dHot5WwYRRoavu7Ais', + response: { + clientDataJSON: + 'eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiWjI5dloyeGxMVzloZFhSb01ud3hNREUyTVRFME1EUTVOREk1T0RRek56YzROak0iLCJvcmlnaW4iOiJodHRwczpcL1wvbG9naW4uYXV0aHJlc3MuaW8iLCJhbmRyb2lkUGFja2FnZU5hbWUiOiJjb20uYW5kcm9pZC5jaHJvbWUifQ', + attestationObject: + 'o2NmbXRxYW5kcm9pZC1zYWZldHluZXRnYXR0U3RtdKJjdmVyaTI1MjAzNzAyOWhyZXNwb25zZVkf_WV5SmhiR2NpT2lKU1V6STFOaUlzSW5nMVl5STZXeUpOU1VsR1RXcERRMEpDY1dkQmQwbENRV2RKVWtGTEswZFhaRGR0ZFRocE1rTjFNbGs0Tmk5dk1DOVZkMFJSV1VwTGIxcEphSFpqVGtGUlJVeENVVUYzVDNwRlRFMUJhMGRCTVZWRlFtaE5RMVpXVFhoSWFrRmpRbWRPVmtKQmIxUkdWV1IyWWpKa2MxcFRRbFZqYmxaNlpFTkNWRnBZU2pKaFYwNXNZM3BGVFUxQmIwZEJNVlZGUVhoTlJGWXhTVEJOUWpSWVJGUkpNVTFFVVhsUFZFRTBUVVJCTUU1R2IxaEVWRWt4VFVSamVVOUVRVFJOUkVFd1RURnZkMGhVUldKTlFtdEhRVEZWUlVGNFRWTlpXRkl3V2xoT01FeHRSblZhU0VwMllWZFJkVmt5T1hSTlNVbENTV3BCVGtKbmEzRm9hMmxIT1hjd1FrRlJSVVpCUVU5RFFWRTRRVTFKU1VKRFowdERRVkZGUVRGVFJrcE1aR0Y0TTNVcllYRmxaVkJPWWt4NFlqRjJUelEwTWxGRFN5OUROekZCUW5GcWVrNVNWVlp3ZUM5eFRIZ3pSMGhGZDAxTFpVdzNjVVpHVG1WTmVVcExSRW8xU0ZCVk5qQm5NRWw0Tm5BM1FtbFBkbXRFVlhvck1sRnFWalJ3V2pWMU5rMDRVekJtVGpkbGJuaFJjSGhJUWtrdkx6VnhNMUUxY2tGVk1UQkRZMWhZZHpoYVpYVlZRa3BTUW5kMVVscDJiVE0xYlZsWFJsVnZkRmQyWVVSRVNYcGFlWFV6TVdST1MyeExkREJUWWtWMVJubGpaVmRhT0dKaGIzUkNkVWRtYUZveE1HeElSMHRtV0VORFVqWXpkVnBOU0Uxa2NHVjVWa280ZHpkemIxZzJkMnRoZFZwd1lsRTFSMWs0VkRKUWJFbFBlRWxsV2tVeWNWcGtha3RLV2paVFdrOVhTalo0V1VNelduUmFOM2hhUldzMmFEbHlOSEZ0VlN0VVlXSkVOM00zVEhGSFZIWTRTRlF4YjJNNWQyRTRLMmhrTDNNNWRHZFpRbTB4UlROaWJIWTRiVFZZUlhrdlNHbFhTbEpJVVVsRVFWRkJRbTgwU1VOVVZFTkRRV3RyZDBSbldVUldVakJRUVZGSUwwSkJVVVJCWjFkblRVSk5SMEV4VldSS1VWRk5UVUZ2UjBORGMwZEJVVlZHUW5kTlFrMUJkMGRCTVZWa1JYZEZRaTkzVVVOTlFVRjNTRkZaUkZaU01FOUNRbGxGUmtoYU1HWm5OVXhVUTNSYU9HZEhkRmRzZDBkTU1sY3hSbmhRUzAxQ09FZEJNVlZrU1hkUldVMUNZVUZHU25aSlJXSjNPWEZxWVRWTldYaFBhakJVVmxaNlNYWjNPRUpvVFVZMFIwTkRjMGRCVVZWR1FuZEZRa0pHU1hkVlJFRnVRbWRuY2tKblJVWkNVV04zUVZsWlltRklVakJqUkc5MlRESTRkV05IZEhCTWJXUjJZakpqZG1ONU9UTmphbEYyWTJwU1drMURWVWREUTNOSFFWRlZSa0o2UVVOb2FHeHZaRWhTZDA5cE9IWmhVelYzWVRKcmRWb3lPWFphZVRrelkycFJkVmt6U2pCTlFqQkhRVEZWWkVWUlVWZE5RbE5EUlcxR01HUkhWbnBrUXpWb1ltMVNlV0l5Ykd0TWJVNTJZbFJCVkVKblRsWklVMEZGUkVSQlMwMUJaMGRDYldWQ1JFRkZRMEZVUVRKQ1owNVdTRkk0UlV4NlFYUk5RM1ZuUzJGQmJtaHBWbTlrU0ZKM1QyazRkbGw1TlhkaE1tdDFXakk1ZGxwNU9UTmphbEYyV1d0V1UxcHJNVWxSVlZrMVZEQlZkVmt6U25OTlNVbENRbWRaUzB0M1dVSkNRVWhYWlZGSlJVRm5VMEk1ZDFOQ09VRkVlVUZJWTBFelpIcExUa3BZV0RSU1dVWTFOVlY1SzNObFppdEVNR05WVGk5aVFVUnZWVVZ1V1V0TVMzazNlVU52UVVGQlIxZG5UV05PUW5kQlFVSkJUVUZUUkVKSFFXbEZRVGR4VGk5U1ExQk5ia3RLUkZCclIzbExkRUZtWjJVd1ExUmxkV2xHU1ZVM04yMDVLM2MyVTJJMGJqQkRTVkZEYjBZME0zRTNTV052U0hZMU1tZG5TR1l4VG01eE0zWnhVM1IzUWs4MlpHOHZkRkpsTkVGNWExTnRkMEl6UVUxNk4wUXljVVpqVVd4c0wzQlhZbFU0TjNCemJuZHBObGxXWTBSYVpVNTBjV3dyVmsxRUsxUkJNbmRCUVVGQ2JHOUVTRVZQT0VGQlFWRkVRVVZuZDFKblNXaEJTMnd5VFV0YWNVVlNjV1pNWkVwaEt6bERNemRXU0dWTk5rWjFSRlIyVmpkNGRHeDFTR2hWVTBkdFpFRnBSVUZ5VlRVMGRtdFVUR3A2VDI0NEwyODNVVkkwZUN0ek9FWmlkV1JMV1M5a01VUXZiekI0YkZsNGJHVTRkMFJSV1VwTGIxcEphSFpqVGtGUlJVeENVVUZFWjJkRlFrRktOMDFwVVd4M2JqaHJiV1ppWVVKM1NUTmtWakI1Vm5RMWF6WkRMMjlIZUVWaldYQlpTRUZIU2pJMU5saG9lSFZtYTBoaFkzZGFVRkJ4VVdZNU5Fc3dWRWRRVkVKMGJGRmlRVFJoU0doME4wbExPVWRHYTBOdk5IbHVSbHBKTVN0NWNXUjVXbmh6ZW1aU1pVSTFRVXhJTTNoa2NqQnFMMmRhVG5OQlpDdFJSakUwUTBoUGJsWTVOV1pOVVc1dVNXaDFieXQxWWtoVFpVMTNlREJ0ZVcxdGJWUldRVGs0Wm5rMmRYaDBZWFZaVUZocVozZ3JPVGxQVm05U2FYaEtOWGg0VlVkVlRGcEpjaTlHZVRodE1tZEhRMGR0UlU5alMwcExUbmQxUWprMmNYRjJLMVpaZFM5QlZuUTJUMHh0V1RONGIydEdLMmgzWkVZMmNURXZWRkZwYTJGeVFuUjBWVmxSV25Bd1QwZDVhM1pJTVZGelIwMDNSRU12TmpORU0weEtRMFIwV1U0eUsxa3ZkRmdyWm14T2IzazVibXByTTNSSE1GcEplVzB4ZUhKNE1FcDVSSFF5VVRCb1dYUnFTRVpoTDI4M2RrVTlJaXdpVFVsSlJrTjZRME5CZGs5blFYZEpRa0ZuU1ZGbUwwRkdkRTV3TVhWSGNHRjRhQzlyVFVoalZIcFVRVTVDWjJ0eGFHdHBSemwzTUVKQlVYTkdRVVJDU0UxUmMzZERVVmxFVmxGUlIwVjNTbFpWZWtWcFRVTkJSMEV4VlVWRGFFMWFVakk1ZGxveWVHeEpSbEo1WkZoT01FbEdUbXhqYmxwd1dUSldla2xGZUUxUmVrVlZUVUpKUjBFeFZVVkJlRTFNVWpGU1ZFbEdTblppTTFGblZXcEZkMGhvWTA1TmFrMTRUV3BGZWsxRWEzZE5SRUYzVjJoalRrMXFhM2ROYWtsM1RWUlJkMDFFUVhkWGFrRTNUVkZ6ZDBOUldVUldVVkZIUlhkS1ZsVjZSV1ZOUW5kSFFURlZSVU5vVFZaU01qbDJXako0YkVsR1VubGtXRTR3U1VaT2JHTnVXbkJaTWxaNlRWRjNkME5uV1VSV1VWRkVSWGRPV0ZWcVVYZG5aMFZwVFVFd1IwTlRjVWRUU1dJelJGRkZRa0ZSVlVGQk5FbENSSGRCZDJkblJVdEJiMGxDUVZGRGRsUnNSeTk2YkVOck5qUTBPV3RoVnk5RVEyOXBjVzl3TUhCSmQzbGhUamhMVVVkaWMxWXlNSE55TUdJME1qbEtjbEpOVVV4S1ZDODNjMGxTVEhOWVpISldZMEUxTnpjMVZqbFlVUzlHYkZaUVZYTjVSbEZoVjBoRmVHZGhVV0ZtTWxCYWVFNVdhMWxtVkRsVFZEVTNZVGxWWWxZclRsUnNaR051YlhoMmIyOU1iWEJvZHk5VVJuWnNibkJ4TW5KTk1UVjViRWhwY1Roc1IzRm5VWEJTT1M4MlFVeDFiMnh0VjBSV1QxQkdSV2RCYkZSa09WRnZSVmM1WjB4TmRVY3piRTh6TVd4MGMyVnVXbGRVTVd4RFVWTXlVbEpXVTNoWWFqZGpVak15YkZoblUwVnphekZhZWpVM1pWSnNaME5tZVdaQmRsVktWWFJOZERrNE1uTnZUbEl5WkhwUFZrOUxhamw2YkdsbFJuSmlaR1pDV21oNFdraFJiamRKU25WSFkyTmthVXB1UzFSVVpXSkNhbmhOYUZWalZVaHJOako1YkU4M1oyVk1kR0l6U2sxVlltSnVkbE5aUkRKVlFXTnNaM3B5ZDJ4QlowMUNRVUZIYW1kbU5IZG5abk4zUkdkWlJGWlNNRkJCVVVndlFrRlJSRUZuUjBkTlFqQkhRVEZWWkVwUlVWZE5RbEZIUTBOelIwRlJWVVpDZDAxQ1FtZG5ja0puUlVaQ1VXTkVRV3BCVTBKblRsWklVazFDUVdZNFJVTkVRVWRCVVVndlFXZEZRVTFDTUVkQk1WVmtSR2RSVjBKQ1UySjVRa2M0VUdGdk1uVlVSMDFVYnpsRk1WWmplVXc0VUVGWlZFRm1RbWRPVmtoVFRVVkhSRUZYWjBKVWEzSjVjMjFqVW05eVUwTmxSa3d4U20xTVR5OTNhVkpPZUZCcVFUQkNaMmR5UW1kRlJrSlJZMEpCVVZGdlRVTlpkMHBCV1VsTGQxbENRbEZWU0UxQlMwZEhSMmd3WkVoQk5reDVPWEJNYmtKeVlWTTFibUl5T1c1TU0wbDRURzFPZVdSRVFYSkNaMDVXU0ZJNFJVcEVRV2xOUTBOblNIRkJZMmhvY0c5a1NGSjNUMms0ZGxsNU5YZGhNbXQxV2pJNWRscDVPWGxNTTBsNFRHMU9lV0pFUVZSQ1owNVdTRk5CUlVSRVFVdE5RV2RIUW0xbFFrUkJSVU5CVkVGT1FtZHJjV2hyYVVjNWR6QkNRVkZ6UmtGQlQwTkJaMFZCYURKdVJEbFhSRFZ6YTNwVlRFRjRiVWxrZEhoV1dscEdPQzgxZDNRMWFXWkpUVlZCVlZKT1ZuZGFZMHc1ZFhWUGRuSk9WRGMxY0Zab2VUTlpOR1J4T1ZCMFFrUjVTVzFuVkdOSldISnhjRGhGVEd4UlNHSk5SMUl5YjI1RE1YazFhRkpwYjFJelIwY3hTamh4UjBKbE0wSXhSRkY2YmpCeGJ6VkhhM0o0TkdscGFpOWtOblI1YjBkNFpucGtRWFowVUZKUksyczJVR0ZZWVRoTVYyUm9hbkJUTHk5WFJtZFBOazFZVDB0bE5uRlVhV05XYldvMk5GaFpkMnB2UkZGWlRuVlpTSFJEVjFCR2NsYzRhVzFEWkROU01UVklLek5MYkVOdVRUZEdkbEY1WkU1eU1EUk1VRlYwTDB4WlRUaEhXa2hDU25sVmNURnZXSFpGTlZKTFYydHZkekZRZEVod2RXMHpPVGgxUjNsV2VtWXJkblVyTURGcEwyMWtSRkZ3YzJJdlNTOVFVVlk1UWtGS2FXNDVSVEpqWmxsTWJFRnpUbXc1Vm1GVmIxVnBaemx4ZFd4VEsycHJibVJvZEU5VFVXTlhkSGMyTWxsTWRVZHZMM2xKT1dOR05GVlpOSEU1YkZkblRrODNURGxKVmxaSVVXODVORzlEY2t3eFoxSk5TMEZPZEVacllXTk1SRVZEZDBGMVJsTkxkblZvWVRkRVlXNVpOMmhhTjFseFJqWklhMDVzU25wVVFUWlpPVlZTVG5FNVRYaHhTbWhOWlZSa2EyVm1laXR6TVVGa0wxRlpNR1V5VFVoSFoySkZLMjlPWkRSaGQxUmtja1Y0VXpKQ01rVndOM2RqVTJreGIwRXpOSEJKWVVwblVYVlhkVGhHY205alEzTjZjM0ZqSzI5S1YxUnlkekpXVVdkbE9YaG5WVnBWVFZwTVVsZGlSalJxTTBaTFVITldWbWRXS3pkbk9UVlNUa1ZxUjJoRE1VMDRUR0Z6T0hkM05WUXJkVUpRVFV4elUxRnJNa0pTU0dOM1pubEVVakl3T1RKS1JteGtSM1ZCT0UxVlFYSkhUaTl1U0ZSRVpsZGhXVXhKVUVOVmFIZENhSEJaVDJwTGJtazBaVkJNY21Ga2NUZEJSekpSYjBkV2MzcGFkMmRLWlhGTVdFcENaaXRKTm01NWVrWmtNbU0xVDFoTlJ6WTFUbU05SWl3aVRVbEpSbGxxUTBOQ1JYRm5RWGRKUWtGblNWRmtOekJPWWs1ek1pdFNjbkZKVVM5Rk9FWnFWRVJVUVU1Q1oydHhhR3RwUnpsM01FSkJVWE5HUVVSQ1dFMVJjM2REVVZsRVZsRlJSMFYzU2tOU1ZFVmFUVUpqUjBFeFZVVkRhRTFSVWpKNGRsbHRSbk5WTW14dVltbENkV1JwTVhwWlZFVlJUVUUwUjBFeFZVVkRlRTFJVlcwNWRtUkRRa1JSVkVWaVRVSnJSMEV4VlVWQmVFMVRVako0ZGxsdFJuTlZNbXh1WW1sQ1UySXlPVEJKUlU1Q1RVSTBXRVJVU1hkTlJGbDRUMVJCZDAxRVFUQk5iRzlZUkZSSk5FMUVSWGxQUkVGM1RVUkJNRTFzYjNkU2VrVk1UVUZyUjBFeFZVVkNhRTFEVmxaTmVFbHFRV2RDWjA1V1FrRnZWRWRWWkhaaU1tUnpXbE5DVldOdVZucGtRMEpVV2xoS01tRlhUbXhqZVVKTlZFVk5lRVpFUVZOQ1owNVdRa0ZOVkVNd1pGVlZlVUpUWWpJNU1FbEdTWGhOU1VsRFNXcEJUa0puYTNGb2EybEhPWGN3UWtGUlJVWkJRVTlEUVdjNFFVMUpTVU5EWjB0RFFXZEZRWFJvUlVOcGVEZHFiMWhsWWs4NWVTOXNSRFl6YkdGa1FWQkxTRGxuZG13NVRXZGhRMk5tWWpKcVNDODNOazUxT0dGcE5saHNOazlOVXk5cmNqbHlTRFY2YjFGa2MyWnVSbXc1TjNaMVprdHFObUozVTJsV05tNXhiRXR5SzBOTmJuazJVM2h1UjFCaU1UVnNLemhCY0dVMk1tbHRPVTFhWVZKM01VNUZSRkJxVkhKRlZHODRaMWxpUlhaekwwRnRVVE0xTVd0TFUxVnFRalpITURCcU1IVlpUMFJRTUdkdFNIVTRNVWs0UlRORGQyNXhTV2x5ZFRaNk1XdGFNWEVyVUhOQlpYZHVha2g0WjNOSVFUTjVObTFpVjNkYVJISllXV1pwV1dGU1VVMDVjMGh0YTJ4RGFYUkVNemh0TldGblNTOXdZbTlRUjJsVlZTczJSRTl2WjNKR1dsbEtjM1ZDTm1wRE5URXhjSHB5Y0RGYWEybzFXbEJoU3pRNWJEaExSV280UXpoUlRVRk1XRXd6TW1nM1RURmlTM2RaVlVnclJUUkZlazVyZEUxbk5sUlBPRlZ3YlhaTmNsVndjM2xWY1hSRmFqVmpkVWhMV2xCbWJXZG9RMDQyU2pORGFXOXFOazlIWVVzdlIxQTFRV1pzTkM5WWRHTmtMM0F5YUM5eWN6TTNSVTlsV2xaWWRFd3diVGM1V1VJd1pYTlhRM0oxVDBNM1dFWjRXWEJXY1RsUGN6WndSa3hMWTNkYWNFUkpiRlJwY25oYVZWUlJRWE0yY1hwcmJUQTJjRGs0WnpkQ1FXVXJaRVJ4Tm1SemJ6UTVPV2xaU0RaVVMxZ3ZNVmszUkhwcmRtZDBaR2w2YW10WVVHUnpSSFJSUTNZNVZYY3JkM0E1VlRkRVlrZExiMmRRWlUxaE0wMWtLM0IyWlhvM1Z6TTFSV2xGZFdFckszUm5lUzlDUW1wR1JrWjVNMnd6VjBad1R6bExWMmQ2TjNwd2JUZEJaVXRLZERoVU1URmtiR1ZEWm1WWWEydFZRVXRKUVdZMWNXOUpZbUZ3YzFwWGQzQmlhMDVHYUVoaGVESjRTVkJGUkdkbVp6RmhlbFpaT0RCYVkwWjFZM1JNTjFSc1RHNU5VUzh3YkZWVVltbFRkekZ1U0RZNVRVYzJlazh3WWpsbU5rSlJaR2RCYlVRd05ubExOVFp0UkdOWlFscFZRMEYzUlVGQllVOURRVlJuZDJkblJUQk5RVFJIUVRGVlpFUjNSVUl2ZDFGRlFYZEpRbWhxUVZCQ1owNVdTRkpOUWtGbU9FVkNWRUZFUVZGSUwwMUNNRWRCTVZWa1JHZFJWMEpDVkd0eWVYTnRZMUp2Y2xORFpVWk1NVXB0VEU4dmQybFNUbmhRYWtGbVFtZE9Wa2hUVFVWSFJFRlhaMEpTWjJVeVdXRlNVVEpZZVc5c1VVd3pNRVY2VkZOdkx5OTZPVk42UW1kQ1oyZHlRbWRGUmtKUlkwSkJVVkpWVFVaSmQwcFJXVWxMZDFsQ1FsRlZTRTFCUjBkSFYyZ3daRWhCTmt4NU9YWlpNMDUzVEc1Q2NtRlROVzVpTWpsdVRESmtlbU5xUlhkTFVWbEpTM2RaUWtKUlZVaE5RVXRIU0Zkb01HUklRVFpNZVRsM1lUSnJkVm95T1haYWVUbHVZek5KZUV3eVpIcGpha1YxV1ROS01FMUVTVWRCTVZWa1NIZFJjazFEYTNkS05rRnNiME5QUjBsWGFEQmtTRUUyVEhrNWFtTnRkM1ZqUjNSd1RHMWtkbUl5WTNaYU0wNTVUVk01Ym1NelNYaE1iVTU1WWtSQk4wSm5UbFpJVTBGRlRrUkJlVTFCWjBkQ2JXVkNSRUZGUTBGVVFVbENaMXB1WjFGM1FrRm5TWGRFVVZsTVMzZFpRa0pCU0ZkbFVVbEdRWGRKZDBSUldVeExkMWxDUWtGSVYyVlJTVVpCZDAxM1JGRlpTa3R2V2tsb2RtTk9RVkZGVEVKUlFVUm5aMFZDUVVSVGEwaHlSVzl2T1VNd1pHaGxiVTFZYjJnMlpFWlRVSE5xWW1SQ1drSnBUR2M1VGxJemREVlFLMVEwVm5obWNUZDJjV1pOTDJJMVFUTlNhVEZtZVVwdE9XSjJhR1JIWVVwUk0ySXlkRFo1VFVGWlRpOXZiRlZoZW5OaFRDdDVlVVZ1T1Zkd2NrdEJVMDl6YUVsQmNrRnZlVnBzSzNSS1lXOTRNVEU0Wm1WemMyMVliakZvU1ZaM05ERnZaVkZoTVhZeGRtYzBSblkzTkhwUWJEWXZRV2hUY25jNVZUVndRMXBGZERSWGFUUjNVM1I2Tm1SVVdpOURURUZPZURoTVdtZ3hTamRSU2xacU1tWm9UWFJtVkVweU9YYzBlak13V2pJd09XWlBWVEJwVDAxNUszRmtkVUp0Y0haMldYVlNOMmhhVERaRWRYQnplbVp1ZHpCVGEyWjBhSE14T0dSSE9WcExZalU1VldoMmJXRlRSMXBTVm1KT1VYQnpaek5DV214MmFXUXdiRWxMVHpKa01YaHZlbU5zVDNwbmFsaFFXVzkyU2twSmRXeDBlbXROZFRNMGNWRmlPVk42TDNscGJISmlRMmRxT0QwaVhYMC5leUp1YjI1alpTSTZJblpvUmxadE5UbG9NR1JCWVZwNWJVTlZVMnBPZGtJNWJFdHZPSGRVV2t0REsybDVWbWhYZW5kYUwwazlJaXdpZEdsdFpYTjBZVzF3VFhNaU9qRTNORGsxTURFMk5ESTVPRGtzSW1Gd2ExQmhZMnRoWjJWT1lXMWxJam9pWTI5dExtZHZiMmRzWlM1aGJtUnliMmxrTG1kdGN5SXNJbUZ3YTBScFoyVnpkRk5vWVRJMU5pSTZJazlyU2tscWVHeDBhbVpYY1hsMEwwYzVTamRrTVZkblREUjBVUzg0WlRoSlNITTJja1UzWTNGWlkzYzlJaXdpWTNSelVISnZabWxzWlUxaGRHTm9JanBtWVd4elpTd2lZWEJyUTJWeWRHbG1hV05oZEdWRWFXZGxjM1JUYUdFeU5UWWlPbHNpT0ZBeGMxY3dSVkJLWTNOc2R6ZFZlbEp6YVZoTU5qUjNLMDgxTUVWa0sxSkNTVU4wWVhreFp6STBUVDBpWFN3aVltRnphV05KYm5SbFozSnBkSGtpT25SeWRXVXNJbVYyWVd4MVlYUnBiMjVVZVhCbElqb2lRa0ZUU1VNaUxDSmtaWEJ5WldOaGRHbHZia2x1Wm05eWJXRjBhVzl1SWpvaVZHaGxJRk5oWm1WMGVVNWxkQ0JCZEhSbGMzUmhkR2x2YmlCQlVFa2dhWE1nWkdWd2NtVmpZWFJsWkM0Z1NYUWdhWE1nY21WamIyMXRaVzVrWldRZ2RHOGdkWE5sSUhSb1pTQlFiR0Y1SUVsdWRHVm5jbWwwZVNCQlVFazZJR2gwZEhCek9pOHZaeTVqYnk5d2JHRjVMM05oWm1WMGVXNWxkQzEwYVcxbGJHbHVaUzRpZlEuUnpfZklvRjM3SE5CV05Db2NtckdxLXpsVDMtbUZJZkZvand5YUxiWXJ4dVpwcldxZ0RmNFo4SDBvMVY1WllmcWdXckw2bHNkVVlnZkxmTGRrRjFTQUhiT1U1cEVhYlQzVzdNRUdLLVBiNkZsRlg4NWpMYllSNmVSY3BFV2lVeTVvci1FMVhNSTIwand1Qk10UkJOVnVuV2JqV2gtVkJwWjZTcWRfZURfN3hiSnd0NFdXNW5kZDdZRHB1U3FETThiVldFRHRMOF9yTjRacUhndzJ1ZDI5NUswNHlaTmVTNkdKb0JDdFNzYVAyTjhRdmIwcXl3UlFlWWd6Vi1pVDlkREpnSnVfS1ExWWxmN0N3Nm9nOG56b3l5c1pvMFZXc3BnUnV2eUFFQTFjVFhVSXhISC1nQTVvRWtsTlZJbmtudHNoZWlBc1AtTlFhR25ITUVRVkhYMlNnaGF1dGhEYXRhWMVohwRhK0KVlcdgFyyI6dEhDIutzOO6c9Ae1qAfEXAiQkUAAAAAuT_ZYfLmRi-xIoIAIkfeeABBAS_TChPtwkqgPwDxkkF39yjfaPJtKiwMGIY69EV7udG2xaP8hYnjJsPS7VPnUA2xaUZc7dHot5WwYRRoavu7AiulAQIDJiABIVgg2nChB8Re-aOqUtqbEDUD6BE18yvs5eixZ5gOA5O3Q14iWCDf6BSjMgCAznWaVDQsxx7PdxJFvRwEqqUqA4D7EmNQWQ', + }, + clientExtensionResults: {}, + type: 'public-key', + }, + expectedChallenge: 'Z29vZ2xlLW9hdXRoMnwxMDE2MTE0MDQ5NDI5ODQzNzc4NjM', + expectedOrigin: 'https://login.authress.io', + expectedRPID: 'authress.io', + requireUserVerification: false, + requireUserPresence: false, + attestationSafetyNetEnforceCTSCheck: false, // <---- Skipping enforcement here + }); + + assert(verification.verified); + + mockDate.restore(); +}); /** * Various Attestations Below */ diff --git a/packages/server/src/registration/verifyRegistrationResponse.ts b/packages/server/src/registration/verifyRegistrationResponse.ts index 4e37656d..33bc8e68 100644 --- a/packages/server/src/registration/verifyRegistrationResponse.ts +++ b/packages/server/src/registration/verifyRegistrationResponse.ts @@ -48,6 +48,7 @@ export type VerifyRegistrationResponseOpts = Parameters { const { @@ -70,6 +72,7 @@ export async function verifyRegistrationResponse( requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = supportedCOSEAlgorithmIdentifiers, + attestationSafetyNetEnforceCTSCheck = true, } = options; const { id, rawId, type: credentialType, response: attestationResponse } = response; @@ -248,6 +251,7 @@ export async function verifyRegistrationResponse( credentialPublicKey, rootCertificates, rpIdHash, + attestationSafetyNetEnforceCTSCheck, }; /** @@ -364,4 +368,5 @@ export type AttestationFormatVerifierOpts = { rootCertificates: string[]; rpIdHash: Uint8Array_; verifyTimestampMS?: boolean; + attestationSafetyNetEnforceCTSCheck?: boolean; };