From 38a46168183e5a808989bdc16d1fc27acfcc0beb Mon Sep 17 00:00:00 2001 From: Nicolas Temciuc Date: Tue, 4 Feb 2025 21:01:56 -0300 Subject: [PATCH 1/3] feat!: remove `token binding` support --- lib/webauthn/authenticator_response.rb | 6 ------ lib/webauthn/client_data.rb | 14 ------------- lib/webauthn/fake_client.rb | 8 +------- .../authenticator_assertion_response_spec.rb | 16 --------------- ...authenticator_attestation_response_spec.rb | 20 ------------------- 5 files changed, 1 insertion(+), 63 deletions(-) diff --git a/lib/webauthn/authenticator_response.rb b/lib/webauthn/authenticator_response.rb index c31f45d4..8f97c7d9 100644 --- a/lib/webauthn/authenticator_response.rb +++ b/lib/webauthn/authenticator_response.rb @@ -13,7 +13,6 @@ class AuthenticatorDataVerificationError < VerificationError; end class ChallengeVerificationError < VerificationError; end class OriginVerificationError < VerificationError; end class RpIdVerificationError < VerificationError; end - class TokenBindingVerificationError < VerificationError; end class TopOriginVerificationError < VerificationError; end class TypeVerificationError < VerificationError; end class UserPresenceVerificationError < VerificationError; end @@ -31,7 +30,6 @@ def verify(expected_challenge, expected_origin = nil, user_presence: nil, user_v rp_id ||= relying_party.id verify_item(:type) - verify_item(:token_binding) verify_item(:challenge, expected_challenge) verify_item(:origin, expected_origin) verify_item(:top_origin) if needs_top_origin_verification? @@ -82,10 +80,6 @@ def valid_type? client_data.type == type end - def valid_token_binding? - client_data.valid_token_binding_format? - end - def valid_top_origin? return false unless client_data.cross_origin diff --git a/lib/webauthn/client_data.rb b/lib/webauthn/client_data.rb index ea31ca0a..eff72a28 100644 --- a/lib/webauthn/client_data.rb +++ b/lib/webauthn/client_data.rb @@ -9,8 +9,6 @@ module WebAuthn class ClientDataMissingError < Error; end class ClientData - VALID_TOKEN_BINDING_STATUSES = ["present", "supported", "not-supported"].freeze - def initialize(client_data_json) @client_data_json = client_data_json end @@ -27,10 +25,6 @@ def origin data["origin"] end - def token_binding - data["tokenBinding"] - end - def cross_origin data["crossOrigin"] end @@ -39,14 +33,6 @@ def top_origin data["topOrigin"] end - def valid_token_binding_format? - if token_binding - token_binding.is_a?(Hash) && VALID_TOKEN_BINDING_STATUSES.include?(token_binding["status"]) - else - true - end - end - def hash OpenSSL::Digest::SHA256.digest(client_data_json) end diff --git a/lib/webauthn/fake_client.rb b/lib/webauthn/fake_client.rb index 027ef704..d02b7548 100644 --- a/lib/webauthn/fake_client.rb +++ b/lib/webauthn/fake_client.rb @@ -10,20 +10,18 @@ module WebAuthn class FakeClient TYPES = { create: "webauthn.create", get: "webauthn.get" }.freeze - attr_reader :origin, :cross_origin, :top_origin, :token_binding, :encoding + attr_reader :origin, :cross_origin, :top_origin, :encoding def initialize( origin = fake_origin, cross_origin: nil, top_origin: nil, - token_binding: nil, authenticator: WebAuthn::FakeAuthenticator.new, encoding: WebAuthn.configuration.encoding ) @origin = origin @cross_origin = cross_origin @top_origin = top_origin - @token_binding = token_binding @authenticator = authenticator @encoding = encoding end @@ -137,10 +135,6 @@ def data_json_for(method, challenge) origin: origin } - if token_binding - data[:tokenBinding] = token_binding - end - if cross_origin data[:crossOrigin] = cross_origin end diff --git a/spec/webauthn/authenticator_assertion_response_spec.rb b/spec/webauthn/authenticator_assertion_response_spec.rb index ce828fe6..93902ae4 100644 --- a/spec/webauthn/authenticator_assertion_response_spec.rb +++ b/spec/webauthn/authenticator_assertion_response_spec.rb @@ -239,22 +239,6 @@ end end - describe "tokenBinding validation" do - let(:client) { WebAuthn::FakeClient.new(actual_origin, token_binding: token_binding, encoding: false) } - - context "it has stuff" do - let(:token_binding) { { status: "supported" } } - - it_behaves_like "a valid assertion response" - end - - context "has an invalid format" do - let(:token_binding) { "invalid token binding format" } - - it_behaves_like "an invalid assertion response that raises", WebAuthn::TokenBindingVerificationError - end - end - describe "rp_id validation" do before do WebAuthn.configuration.rp_id = "different-rp_id" diff --git a/spec/webauthn/authenticator_attestation_response_spec.rb b/spec/webauthn/authenticator_attestation_response_spec.rb index 91ce28a3..eb105df9 100644 --- a/spec/webauthn/authenticator_attestation_response_spec.rb +++ b/spec/webauthn/authenticator_attestation_response_spec.rb @@ -617,26 +617,6 @@ end end - describe "tokenBinding validation" do - let(:client) { WebAuthn::FakeClient.new(origin, token_binding: token_binding, encoding: false) } - - before do - WebAuthn.configuration.allowed_origins = [origin] - end - - context "it has stuff" do - let(:token_binding) { { status: "supported" } } - - it_behaves_like "a valid attestation response" - end - - context "has an invalid format" do - let(:token_binding) { "invalid token binding format" } - - it_behaves_like "an invalid attestation response that raises", WebAuthn::TokenBindingVerificationError - end - end - describe "top_origin validation" do let(:client) { WebAuthn::FakeClient.new(origin, encoding: false, cross_origin: cross_origin, top_origin: client_top_origin) } let(:top_origin) { fake_top_origin } From 0095150bedaa244d7fb7a1d25d83b8c9896d72f0 Mon Sep 17 00:00:00 2001 From: Nicolas Temciuc Date: Thu, 22 Oct 2026 10:24:55 -0300 Subject: [PATCH 2/3] docs: update CHANGELOG --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 127d5532..883f1b98 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ - Add support for crossOrigin/topOrigin verification during credential registration and authentication. [#486](https://github.com/cedarcode/webauthn-ruby/pull/486) [@nicolastemciuc] +### Removed + +- Remove `TokenBinding` verification during credential registration and authentication. [#450](https://github.com/cedarcode/webauthn-ruby/pull/450) [@nicolastemciuc] + ## [v3.4.3](https://github.com/cedarcode/webauthn-ruby/compare/v3.4.2...v3.4.3/) - 2025-10-23 ### Fixed From c7879222c7d56193c8ee11936385849f9ad78e39 Mon Sep 17 00:00:00 2001 From: Nicolas Temciuc Date: Thu, 22 Oct 2026 14:07:20 -0300 Subject: [PATCH 3/3] Update CHANGELOG.md Co-authored-by: Santiago Rodriguez <46354312+santiagorodriguez96@users.noreply.github.com> --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 883f1b98..9ee77ec0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,9 @@ ### Removed - Remove `TokenBinding` verification during credential registration and authentication. [#450](https://github.com/cedarcode/webauthn-ruby/pull/450) [@nicolastemciuc] + - BREAKING CHANGE: `WebAuthn::TokenBindingVerificationError` no longer exists. Remove it from any `rescue` clauses. + - BREAKING CHANGE: `WebAuthn::FakeClient.new` no longer accepts `token_binding:`. + - BREAKING CHANGE: `WebAuthn::ClientData` no longer exposes `#token_binding` or `#valid_token_binding_format?`. ## [v3.4.3](https://github.com/cedarcode/webauthn-ruby/compare/v3.4.2...v3.4.3/) - 2025-10-23