**Add Webauthn authentication implementation**

Introduce Webauthn-based authentication handler with supporting classes and updates. This includes a new `WebauthnAuthenticator`, `WebauthnBadge`, `WebauthnBadgeListener`, and associated passport classes to handle the Webauthn authentication workflow. Additionally, various configuration, security services, and tests were updated to integrate Webauthn support.

Author: Spomky

composer.json

@@ -45,16 +45,16 @@
         "ext-json": "*",
         "ext-openssl": "*",
         "paragonie/constant_time_encoding": "^2.6|^3.0",
+        "phpdocumentor/reflection-docblock": "^5.3",
         "psr/clock": "^1.0",
         "psr/event-dispatcher": "^1.0",
         "psr/log": "^1.0|^2.0|^3.0",
-        "phpdocumentor/reflection-docblock": "^5.3",
         "spomky-labs/cbor-php": "^3.0",
         "spomky-labs/pki-framework": "^1.0",
+        "symfony/clock": "^6.4|^7.0",
         "symfony/config": "^6.4|^7.0",
         "symfony/dependency-injection": "^6.4|^7.0",
         "symfony/deprecation-contracts": "^3.2",
-        "symfony/clock": "^6.4|^7.0",
         "symfony/framework-bundle": "^6.4|^7.0",
         "symfony/http-client": "^6.4|^7.0",
         "symfony/property-access": "^6.4|^7.0",
@@ -93,6 +93,7 @@
         "doctrine/orm": "^2.14|^3.0",
         "doctrine/persistence": "^3.1|^4.0",
         "ekino/phpstan-banned-code": "^3.0",
+        "ergebnis/phpunit-slow-test-detector": "^2.18",
         "infection/infection": "^0.29",
         "matthiasnoback/symfony-dependency-injection-test": "^5.1|^6.0",
         "php-parallel-lint/php-parallel-lint": "^1.3",

phpunit.xml.dist

@@ -32,4 +32,7 @@
             <file>src/symfony/src/Repository/DummyPublicKeyCredentialUserEntityRepository.php</file>
         </exclude>
     </source>
+    <extensions>
+        <bootstrap class="Ergebnis\PHPUnit\SlowTestDetector\Extension"/>
+    </extensions>
 </phpunit>

src/stimulus/assets/dist/controller.d.ts

@@ -9,6 +9,10 @@ export default class extends Controller {
             type: StringConstructor;
             default: string;
         };
+        requestResultField: {
+            type: StringConstructor;
+            default: null;
+        };
         requestSuccessRedirectUri: StringConstructor;
         creationResultUrl: {
             type: StringConstructor;
@@ -59,6 +63,7 @@ export default class extends Controller {
     };
     readonly requestResultUrlValue: string;
     readonly requestOptionsUrlValue: string;
+    readonly requestResultFieldValue?: string;
     readonly requestSuccessRedirectUriValue?: string;
     readonly creationResultUrlValue: string;
     readonly creationOptionsUrlValue: string;

src/stimulus/assets/dist/controller.js

@@ -5,14 +5,17 @@ class default_1 extends Controller {
     constructor() {
         super(...arguments);
         this.connect = async () => {
-            var _a, _b;
+            var _a, _b, _c;
             const options = {
                 requestResultUrl: this.requestResultUrlValue,
                 requestOptionsUrl: this.requestOptionsUrlValue,
                 requestSuccessRedirectUri: (_a = this.requestSuccessRedirectUriValue) !== null && _a !== undefined ? _a : null,
+                requestResultField: (_a = this.requestResultFieldValue) !== null && _a !== undefined ? _a : null,
+                requestSuccessRedirectUri: (_b = this.requestSuccessRedirectUriValue) !== null && _b !== undefined ? _b : null,
                 creationResultUrl: this.creationResultUrlValue,
                 creationOptionsUrl: this.creationOptionsUrlValue,
                 creationSuccessRedirectUri: (_b = this.creationSuccessRedirectUriValue) !== null && _b !== undefined ? _b : null,
+                creationSuccessRedirectUri: (_c = this.creationSuccessRedirectUriValue) !== null && _c !== undefined ? _c : null,
             };
             this._dispatchEvent('webauthn:connect', { options });
             const supportAutofill = await browserSupportsWebAuthnAutofill();
@@ -38,9 +41,16 @@ class default_1 extends Controller {
         this._processSignin(optionsResponseJson, false);
     }
     async _processSignin(optionsResponseJson, useBrowserAutofill) {
+        var _a;
         try {
             const authenticatorResponse = await startAuthentication({ optionsJSON: optionsResponseJson, useBrowserAutofill });
             this._dispatchEvent('webauthn:authenticator:response', { response: authenticatorResponse });
+            console.log(authenticatorResponse, this.requestResultFieldValue, this.element instanceof HTMLFormElement);
+            if (this.requestResultFieldValue && this.element instanceof HTMLFormElement) {
+                (_a = this.element.querySelector(this.requestResultFieldValue)) === null || _a === void 0 ? void 0 : _a.setAttribute('value', JSON.stringify(authenticatorResponse));
+                this.element.submit();
+                return;
+            }
             const assertionResponse = await this._getAssertionResponse(authenticatorResponse);
             if (assertionResponse !== false && this.requestSuccessRedirectUriValue) {
                 window.location.replace(this.requestSuccessRedirectUriValue);
@@ -151,6 +161,7 @@ class default_1 extends Controller {
 default_1.values = {
     requestResultUrl: { type: String, default: '/request' },
     requestOptionsUrl: { type: String, default: '/request/options' },
+    requestResultField: { type: String, default: null },
     requestSuccessRedirectUri: String,
     creationResultUrl: { type: String, default: '/creation' },
     creationOptionsUrl: { type: String, default: '/creation/options' },

src/stimulus/assets/src/controller.ts

@@ -11,9 +11,11 @@ export default class extends Controller {
     static values = {
         requestResultUrl: { type: String, default: '/request' },
         requestOptionsUrl: { type: String, default: '/request/options' },
+        requestResultField: { type: String, default: null },
         requestSuccessRedirectUri: String,
         creationResultUrl: { type: String, default: '/creation' },
         creationOptionsUrl: { type: String, default: '/creation/options' },
+        creationResultField: { type: String, default: null },
         creationSuccessRedirectUri: String,
         usernameField: { type: String, default: 'username' },
         displayNameField: { type: String, default: 'displayName' },
@@ -32,9 +34,11 @@ export default class extends Controller {
 
     declare readonly requestResultUrlValue: string;
     declare readonly requestOptionsUrlValue: string;
+    declare readonly requestResultFieldValue?: string;
     declare readonly requestSuccessRedirectUriValue?: string;
     declare readonly creationResultUrlValue: string;
     declare readonly creationOptionsUrlValue: string;
+    declare readonly creationResultFieldValue?: string;
     declare readonly creationSuccessRedirectUriValue?: string;
     declare readonly usernameFieldValue: string;
     declare readonly displayNameFieldValue: string;
@@ -49,6 +53,8 @@ export default class extends Controller {
         const options = {
             requestResultUrl: this.requestResultUrlValue,
             requestOptionsUrl: this.requestOptionsUrlValue,
+            requestResultField: this.requestResultFieldValue ?? null,
+            creationResultField: this.creationResultFieldValue ?? null,
             requestSuccessRedirectUri: this.requestSuccessRedirectUriValue ?? null,
             creationResultUrl: this.creationResultUrlValue,
             creationOptionsUrl: this.creationOptionsUrlValue,
@@ -85,6 +91,11 @@ export default class extends Controller {
             // @ts-ignore
             const authenticatorResponse = await startAuthentication({ optionsJSON: optionsResponseJson, useBrowserAutofill });
             this._dispatchEvent('webauthn:authenticator:response', { response: authenticatorResponse });
+            if (this.requestResultFieldValue && this.element instanceof HTMLFormElement) {
+                this.element.querySelector(this.requestResultFieldValue)?.setAttribute('value', JSON.stringify(authenticatorResponse));
+                this.element.submit();
+                return;
+            }
 
             const assertionResponse = await this._getAssertionResponse(authenticatorResponse);
             if (assertionResponse !== false && this.requestSuccessRedirectUriValue) {
@@ -111,6 +122,11 @@ export default class extends Controller {
             // @ts-ignore
             const authenticatorResponse = await startRegistration({ optionsJSON: optionsResponseJson });
             this._dispatchEvent('webauthn:authenticator:response', { response: authenticatorResponse });
+            if (this.creationResultFieldValue && this.element instanceof HTMLFormElement) {
+                this.element.querySelector(this.creationResultFieldValue)?.setAttribute('value', JSON.stringify(authenticatorResponse));
+                this.element.submit();
+                return;
+            }
 
             const attestationResponseJSON = await this._getAttestationResponse(authenticatorResponse);
             if (attestationResponseJSON !== false && this.creationSuccessRedirectUriValue) {

src/symfony/src/Controller/AssertionControllerFactory.php

@@ -23,6 +23,7 @@ final class AssertionControllerFactory implements CanLogData
 
     public function __construct(
         private readonly SerializerInterface $serializer,
+        private readonly OptionsStorage $optionStorage,
         private readonly AuthenticatorAssertionResponseValidator $authenticatorAssertionResponseValidator,
         private readonly PublicKeyCredentialSourceRepositoryInterface $publicKeyCredentialSourceRepository,
     ) {
@@ -36,21 +37,21 @@ public function setLogger(LoggerInterface $logger): void
 
     public function createRequestController(
         PublicKeyCredentialRequestOptionsBuilder $optionsBuilder,
-        OptionsStorage $optionStorage,
+        null|OptionsStorage $optionStorage,
         RequestOptionsHandler $optionsHandler,
         FailureHandler|AuthenticationFailureHandlerInterface $failureHandler
     ): AssertionRequestController {
         return new AssertionRequestController(
             $optionsBuilder,
-            $optionStorage,
+            $optionStorage ?? $this->optionStorage,
             $optionsHandler,
             $failureHandler,
             $this->logger,
         );
     }
 
     public function createResponseController(
-        OptionsStorage $optionStorage,
+        null|OptionsStorage $optionStorage,
         SuccessHandler $successHandler,
         FailureHandler|AuthenticationFailureHandlerInterface $failureHandler,
         null|AuthenticatorAssertionResponseValidator $authenticatorAssertionResponseValidator = null,
@@ -59,7 +60,7 @@ public function createResponseController(
             $this->serializer,
             $authenticatorAssertionResponseValidator ?? $this->authenticatorAssertionResponseValidator,
             $this->logger,
-            $optionStorage,
+            $optionStorage ?? $this->optionStorage,
             $successHandler,
             $failureHandler,
             $this->publicKeyCredentialSourceRepository

src/symfony/src/Controller/AttestationControllerFactory.php

@@ -18,6 +18,7 @@
 final readonly class AttestationControllerFactory
 {
     public function __construct(
+        private OptionsStorage $optionStorage,
         private SerializerInterface $serializer,
         private AuthenticatorAttestationResponseValidator $attestationResponseValidator,
         private PublicKeyCredentialSourceRepositoryInterface $publicKeyCredentialSourceRepository
@@ -27,23 +28,23 @@ public function __construct(
     public function createRequestController(
         PublicKeyCredentialCreationOptionsBuilder $optionsBuilder,
         UserEntityGuesser $userEntityGuesser,
-        OptionsStorage $optionStorage,
+        null|OptionsStorage $optionStorage,
         CreationOptionsHandler $creationOptionsHandler,
         FailureHandler|AuthenticationFailureHandlerInterface $failureHandler,
         bool $hideExistingExcludedCredentials = false
     ): AttestationRequestController {
         return new AttestationRequestController(
             $optionsBuilder,
             $userEntityGuesser,
-            $optionStorage,
+            $optionStorage ?? $this->optionStorage,
             $creationOptionsHandler,
             $failureHandler,
             $hideExistingExcludedCredentials
         );
     }
 
     public function createResponseController(
-        OptionsStorage $optionStorage,
+        null|OptionsStorage $optionStorage,
         SuccessHandler $successHandler,
         FailureHandler|AuthenticationFailureHandlerInterface $failureHandler,
         null|AuthenticatorAttestationResponseValidator $attestationResponseValidator = null,
@@ -52,7 +53,7 @@ public function createResponseController(
             $this->serializer,
             $attestationResponseValidator ?? $this->attestationResponseValidator,
             $this->publicKeyCredentialSourceRepository,
-            $optionStorage,
+            $optionStorage ?? $this->optionStorage,
             $successHandler,
             $failureHandler,
         );

src/symfony/src/DependencyInjection/Configuration.php

@@ -64,6 +64,10 @@ public function getConfigTreeBuilder(): TreeBuilder
                 ->defaultValue('webauthn.clock.default')
                 ->info('PSR-20 Clock service.')
             ->end()
+            ->scalarNode('options_storage')
+                ->defaultValue(SessionStorage::class)
+                ->info('Service responsible of the options/user entity storage during the ceremony')
+            ->end()
             ->scalarNode('event_dispatcher')
                 ->defaultValue(EventDispatcherInterface::class)
                 ->info('PSR-14 Event Dispatcher service.')
@@ -330,7 +334,7 @@ private function addControllersConfig(ArrayNodeDefinition $rootNode): void
             ->defaultValue(Request::METHOD_POST)
             ->end()
             ->scalarNode('result_path')
-            ->isRequired()
+            ->defaultNull()
             ->end()
             ->scalarNode('host')
             ->defaultValue(null)
@@ -354,6 +358,11 @@ private function addControllersConfig(ArrayNodeDefinition $rootNode): void
                 ->defaultFalse()
             ->end()
             ->scalarNode('options_storage')
+            ->setDeprecated(
+                'web-auth/webauthn-symfony-bundle',
+                '5.2.0',
+                'The child node "%node%" at path "%path%" is deprecated. Please use the root option "options_storage" instead.'
+            )
             ->defaultValue(SessionStorage::class)
             ->info('Service responsible of the options/user entity storage during the ceremony')
             ->end()
@@ -411,7 +420,7 @@ private function addControllersConfig(ArrayNodeDefinition $rootNode): void
             ->defaultValue(Request::METHOD_POST)
             ->end()
             ->scalarNode('result_path')
-            ->isRequired()
+            ->defaultNull()
             ->end()
             ->scalarNode('host')
             ->defaultValue(null)
@@ -426,6 +435,11 @@ private function addControllersConfig(ArrayNodeDefinition $rootNode): void
             ->defaultNull()
             ->end()
             ->scalarNode('options_storage')
+            ->setDeprecated(
+                'web-auth/webauthn-symfony-bundle',
+                '5.2.0',
+                'The child node "%node%" at path "%path%" is deprecated. Please use the root option "options_storage" instead.'
+            )
             ->defaultValue(SessionStorage::class)
             ->info('Service responsible of the options/user entity storage during the ceremony')
             ->end()

src/symfony/src/DependencyInjection/Factory/Security/WebauthnFactory.php

@@ -88,7 +88,7 @@
     private const PRIORITY = 0;
 
     public function __construct(
-        private WebauthnServicesFactory $servicesFactory
+        private WebauthnServicesFactory $servicesFactory,
     ) {
     }
 
@@ -112,6 +112,11 @@ public function addConfiguration(NodeDefinition $builder): void
             ->defaultNull()
             ->end()
             ->scalarNode('options_storage')
+            ->setDeprecated(
+                'web-auth/webauthn-symfony-bundle',
+                '5.2.0',
+                'The child node "%node%" at path "%path%" is deprecated. Please use the root option "options_storage" instead.'
+            )
             ->defaultValue(self::DEFAULT_SESSION_STORAGE_SERVICE)
             ->end()
             ->scalarNode('success_handler')
@@ -306,14 +311,16 @@ private function createAssertionControllersAndRoutes(
             $config['authentication']['options_handler'],
             $config['failure_handler'],
         );
-        $this->createResponseControllerAndRoute(
-            $container,
-            $firewallName,
-            'request',
-            $config['authentication']['routes']['result_method'],
-            $config['authentication']['routes']['result_path'],
-            $config['authentication']['routes']['host']
-        );
+        if ($config['authentication']['routes']['result_path'] !== null) {
+            $this->createResponseControllerAndRoute(
+                $container,
+                $firewallName,
+                'request',
+                $config['authentication']['routes']['result_method'],
+                $config['authentication']['routes']['result_path'],
+                $config['authentication']['routes']['host']
+            );
+        }
     }
 
     /**
@@ -340,14 +347,16 @@ private function createAttestationControllersAndRoutes(
             $config['registration']['options_handler'],
             $config['failure_handler'],
         );
-        $this->createResponseControllerAndRoute(
-            $container,
-            $firewallName,
-            'creation',
-            $config['registration']['routes']['result_method'],
-            $config['registration']['routes']['result_path'],
-            $config['registration']['routes']['host']
-        );
+        if ($config['registration']['routes']['result_path'] !== null) {
+            $this->createResponseControllerAndRoute(
+                $container,
+                $firewallName,
+                'creation',
+                $config['registration']['routes']['result_method'],
+                $config['registration']['routes']['result_path'],
+                $config['registration']['routes']['host']
+            );
+        }
     }
 
     private function createAssertionRequestControllerAndRoute(