|
| 1 | +const crypto = require('node:crypto'); |
| 2 | +const { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } = require('@simplewebauthn/server'); |
| 3 | +const User = require('../models/User'); |
| 4 | + |
| 5 | +function generateDefaultPublicKey() { |
| 6 | + // Dummy COSE public key used to force uniform WebAuthn verification on failed logins. |
| 7 | + const { publicKey } = crypto.generateKeyPairSync('ec', { |
| 8 | + namedCurve: 'P-256', |
| 9 | + publicKeyEncoding: { format: 'jwk' }, |
| 10 | + }); |
| 11 | + const x = Buffer.from(publicKey.x, 'base64url'); // 32 bytes |
| 12 | + const y = Buffer.from(publicKey.y, 'base64url'); // 32 bytes |
| 13 | + // COSE_Key: map(5) {1:2, 3:-7, -1:1, -2:x, -3:y} |
| 14 | + return Buffer.concat([Buffer.from([0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20]), x, Buffer.from([0x22, 0x58, 0x20]), y]); |
| 15 | +} |
| 16 | +const DUMMY_COSE_PUBLIC_KEY = generateDefaultPublicKey(); |
| 17 | + |
| 18 | +const rpName = 'Hackathon Starter'; |
| 19 | +const rpID = new URL(process.env.BASE_URL).hostname; |
| 20 | +const expectedOrigin = new URL(process.env.BASE_URL).origin; |
| 21 | + |
| 22 | +/** |
| 23 | + * POST /login/webauthn-start |
| 24 | + */ |
| 25 | +exports.postLoginStart = async (req, res) => { |
| 26 | + try { |
| 27 | + const { email, useEmailWithBiometrics } = req.body; |
| 28 | + req.session.webauthnLoginEmail = useEmailWithBiometrics && email ? email.toLowerCase().trim() : null; |
| 29 | + const options = await generateAuthenticationOptions({ |
| 30 | + rpID, |
| 31 | + userVerification: 'preferred', |
| 32 | + }); |
| 33 | + req.session.loginChallenge = options.challenge; |
| 34 | + res.render('account/webauthn-login', { |
| 35 | + title: 'Biometric Login', |
| 36 | + publicKey: JSON.stringify(options), |
| 37 | + }); |
| 38 | + } catch (err) { |
| 39 | + console.error('Error in postLoginStart:', err); |
| 40 | + req.flash('errors', { msg: 'Passkey / Biometric Failure.' }); |
| 41 | + res.redirect('/login'); |
| 42 | + } |
| 43 | +}; |
| 44 | + |
| 45 | +/** |
| 46 | + * POST /login/webauthn-verify |
| 47 | + */ |
| 48 | +exports.postLoginVerify = async (req, res) => { |
| 49 | + try { |
| 50 | + let noUserFound = false; |
| 51 | + const { credential } = req.body; |
| 52 | + const expectedChallenge = req.session.loginChallenge; |
| 53 | + const scopedEmail = req.session.webauthnLoginEmail; |
| 54 | + delete req.session.webauthnLoginEmail; |
| 55 | + if (!credential || !expectedChallenge) { |
| 56 | + delete req.session.loginChallenge; |
| 57 | + req.flash('errors', { msg: 'Passkey / Biometric authentication failed - invalid request.' }); |
| 58 | + return res.redirect('/login'); |
| 59 | + } |
| 60 | + const parsedCredential = JSON.parse(credential); |
| 61 | + const credentialId = Buffer.from(parsedCredential.id, 'base64url'); |
| 62 | + const user = await User.findOne({ 'webauthnCredentials.credentialId': credentialId }); |
| 63 | + let userCredential; |
| 64 | + if (!user) { |
| 65 | + noUserFound = true; |
| 66 | + userCredential = { credentialId: credentialId, publicKey: DUMMY_COSE_PUBLIC_KEY, counter: 0, transports: [] }; |
| 67 | + } else { |
| 68 | + userCredential = user.webauthnCredentials.find((c) => c.credentialId.equals(credentialId)); |
| 69 | + } |
| 70 | + const verification = await verifyAuthenticationResponse({ |
| 71 | + response: parsedCredential, |
| 72 | + expectedChallenge, |
| 73 | + expectedOrigin, |
| 74 | + expectedRPID: rpID, |
| 75 | + requireUserVerification: false, |
| 76 | + credential: { |
| 77 | + id: userCredential.credentialId, |
| 78 | + publicKey: userCredential.publicKey, |
| 79 | + counter: userCredential.counter, |
| 80 | + transports: userCredential.transports, |
| 81 | + }, |
| 82 | + }); |
| 83 | + delete req.session.loginChallenge; |
| 84 | + if (!verification.verified || noUserFound || (scopedEmail && user.email !== scopedEmail)) { |
| 85 | + if (scopedEmail) { |
| 86 | + req.flash('errors', { msg: 'Passkey / Biometric authentication failed, or did not match the provided email.' }); |
| 87 | + } else { |
| 88 | + req.flash('errors', { msg: 'Passkey / Biometric authentication failed.' }); |
| 89 | + } |
| 90 | + return res.redirect('/login'); |
| 91 | + } |
| 92 | + userCredential.counter = verification.authenticationInfo.newCounter; |
| 93 | + userCredential.lastUsedAt = new Date(); |
| 94 | + await user.save(); |
| 95 | + req.logIn(user, (err) => { |
| 96 | + if (err) { |
| 97 | + console.error('Error in postLoginVerify - Login session error:', err); |
| 98 | + req.flash('errors', { msg: 'Login failed. Please try again.' }); |
| 99 | + return res.redirect('/login'); |
| 100 | + } |
| 101 | + req.flash('success', { msg: 'Success! You are logged in.' }); |
| 102 | + res.redirect(req.session.returnTo || '/'); |
| 103 | + }); |
| 104 | + } catch (err) { |
| 105 | + console.error('Error in postLoginVerify:', err); |
| 106 | + delete req.session.loginChallenge; |
| 107 | + req.flash('errors', { msg: 'Passkey / Biometric authentication failed - system error.' }); |
| 108 | + res.redirect('/login'); |
| 109 | + } |
| 110 | +}; |
| 111 | + |
| 112 | +/** |
| 113 | + * POST /account/webauthn/register |
| 114 | + */ |
| 115 | +exports.postRegisterStart = async (req, res) => { |
| 116 | + try { |
| 117 | + const { user } = req; |
| 118 | + if (!user.emailVerified) { |
| 119 | + req.flash('errors', { msg: 'Please verify your email address before enabling passkey login.' }); |
| 120 | + return res.redirect('/account'); |
| 121 | + } |
| 122 | + if (!user.webauthnUserID) { |
| 123 | + user.webauthnUserID = crypto.randomBytes(32); |
| 124 | + await user.save(); |
| 125 | + } |
| 126 | + const existingCredentials = (user.webauthnCredentials || []).map((cred) => ({ |
| 127 | + id: cred.credentialId, |
| 128 | + type: 'public-key', |
| 129 | + transports: cred.transports, |
| 130 | + })); |
| 131 | + const options = await generateRegistrationOptions({ |
| 132 | + rpName, |
| 133 | + rpID, |
| 134 | + userID: user.webauthnUserID, |
| 135 | + userName: user.email, |
| 136 | + userDisplayName: user.profile?.name || user.email, |
| 137 | + excludeCredentials: existingCredentials, |
| 138 | + authenticatorSelection: { |
| 139 | + residentKey: 'discouraged', |
| 140 | + userVerification: 'preferred', |
| 141 | + }, |
| 142 | + }); |
| 143 | + req.session.registerChallenge = options.challenge; |
| 144 | + res.render('account/webauthn-register', { |
| 145 | + title: 'Enable Biometric Login', |
| 146 | + publicKey: JSON.stringify(options), |
| 147 | + }); |
| 148 | + } catch (err) { |
| 149 | + console.error('Error in postRegisterStart:', err); |
| 150 | + req.flash('errors', { msg: 'Failed to start passkey registration. Please try again.' }); |
| 151 | + res.redirect('/account'); |
| 152 | + } |
| 153 | +}; |
| 154 | + |
| 155 | +/** |
| 156 | + * POST /account/webauthn/verify |
| 157 | + */ |
| 158 | +exports.postRegisterVerify = async (req, res) => { |
| 159 | + try { |
| 160 | + if (!req.user.emailVerified) { |
| 161 | + req.flash('errors', { msg: 'Please verify your email address before enabling passkey login.' }); |
| 162 | + return res.redirect('/account'); |
| 163 | + } |
| 164 | + const { credential } = req.body; |
| 165 | + const expectedChallenge = req.session.registerChallenge; |
| 166 | + if (!credential || !expectedChallenge) { |
| 167 | + delete req.session.registerChallenge; |
| 168 | + req.flash('errors', { msg: 'Registration failed. Please try again.' }); |
| 169 | + return res.redirect('/account'); |
| 170 | + } |
| 171 | + const parsedCredential = JSON.parse(credential); |
| 172 | + const verification = await verifyRegistrationResponse({ |
| 173 | + response: parsedCredential, |
| 174 | + expectedChallenge, |
| 175 | + expectedOrigin, |
| 176 | + expectedRPID: rpID, |
| 177 | + requireUserVerification: false, |
| 178 | + }); |
| 179 | + delete req.session.registerChallenge; |
| 180 | + if (!verification?.verified || !verification.registrationInfo?.credential) { |
| 181 | + req.flash('errors', { msg: 'Registration failed. Please try again.' }); |
| 182 | + return res.redirect('/account'); |
| 183 | + } |
| 184 | + const c = verification.registrationInfo.credential; |
| 185 | + if (!c.id || !c.publicKey) { |
| 186 | + console.error('Error in postRegisterVerify - registrationInfo payload:', verification.registrationInfo); |
| 187 | + req.flash('errors', { msg: 'Registration failed. Please try again.' }); |
| 188 | + return res.redirect('/account'); |
| 189 | + } |
| 190 | + req.user.webauthnCredentials = Array.isArray(req.user.webauthnCredentials) ? req.user.webauthnCredentials : []; |
| 191 | + |
| 192 | + const newCredentialId = Buffer.from(c.id, 'base64url'); |
| 193 | + const alreadyOnUser = req.user.webauthnCredentials.some((cred) => Buffer.isBuffer(cred.credentialId) && cred.credentialId.equals(newCredentialId)); |
| 194 | + if (alreadyOnUser) { |
| 195 | + req.flash('errors', { msg: 'This passkey is already registered to your account.' }); |
| 196 | + return res.redirect('/account'); |
| 197 | + } |
| 198 | + |
| 199 | + req.user.webauthnCredentials.push({ |
| 200 | + credentialId: newCredentialId, |
| 201 | + publicKey: Buffer.from(c.publicKey), |
| 202 | + counter: typeof c.counter === 'number' ? c.counter : 0, |
| 203 | + transports: Array.isArray(c.transports) ? c.transports : [], |
| 204 | + deviceType: verification.registrationInfo.credentialDeviceType, |
| 205 | + backedUp: Boolean(verification.registrationInfo.credentialBackedUp), |
| 206 | + deviceName: 'Biometric Device', |
| 207 | + createdAt: new Date(), |
| 208 | + lastUsedAt: new Date(), |
| 209 | + }); |
| 210 | + try { |
| 211 | + await req.user.save(); |
| 212 | + } catch (err) { |
| 213 | + if (err.code === 11000) { |
| 214 | + req.flash('errors', { msg: 'This passkey is already registered to an account.' }); |
| 215 | + return res.redirect('/account'); |
| 216 | + } |
| 217 | + throw err; |
| 218 | + } |
| 219 | + req.flash('success', { msg: 'Biometric login has been enabled successfully.' }); |
| 220 | + return res.redirect('/account'); |
| 221 | + } catch (err) { |
| 222 | + console.error('Error in postRegisterVerify:', err); |
| 223 | + delete req.session.registerChallenge; |
| 224 | + req.flash('errors', { msg: 'Registration failed. Please try again.' }); |
| 225 | + return res.redirect('/account'); |
| 226 | + } |
| 227 | +}; |
| 228 | + |
| 229 | +/** |
| 230 | + * POST /account/webauthn/remove |
| 231 | + */ |
| 232 | +exports.postRemove = async (req, res) => { |
| 233 | + try { |
| 234 | + req.user.webauthnCredentials = []; |
| 235 | + req.user.webauthnUserID = undefined; |
| 236 | + await req.user.save(); |
| 237 | + req.flash('success', { msg: 'Biometric login has been removed successfully.' }); |
| 238 | + res.redirect('/account'); |
| 239 | + } catch (err) { |
| 240 | + console.error('Error in postRemove:', err); |
| 241 | + req.flash('errors', { msg: 'Failed to remove biometric login. Please try again.' }); |
| 242 | + res.redirect('/account'); |
| 243 | + } |
| 244 | +}; |
0 commit comments