diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ee77ec0..b3b792f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ - Add support for crossOrigin/topOrigin verification during credential registration and authentication. [#486](https://github.com/cedarcode/webauthn-ruby/pull/486) [@nicolastemciuc] +### Changed + +- Bump the default `credential_options_timeout` from `120_000` to `300_000` milliseconds (5 minutes). [#515](https://github.com/cedarcode/webauthn-ruby/pull/515) [@santiagorodriguez96] + ### Removed - Remove `TokenBinding` verification during credential registration and authentication. [#450](https://github.com/cedarcode/webauthn-ruby/pull/450) [@nicolastemciuc] diff --git a/README.md b/README.md index cd92735b..3cab41a2 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,7 @@ WebAuthn.configure do |config| # interaction with the user. # This hint may be overridden by the browser. # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout - # config.credential_options_timeout = 120_000 + # config.credential_options_timeout = 300_000 # You can optionally specify a different Relying Party ID # (https://www.w3.org/TR/webauthn/#relying-party-identifier) diff --git a/docs/advanced_configuration.md b/docs/advanced_configuration.md index 2454065b..1b998817 100644 --- a/docs/advanced_configuration.md +++ b/docs/advanced_configuration.md @@ -32,7 +32,7 @@ Instead of the [Global Configuration](../README.md#configuration) you place in ` # interaction with the user. # This hint may be overridden by the browser. # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout - # credential_options_timeout: 120_000 + # credential_options_timeout: 300_000 # You can optionally specify a different Relying Party ID # (https://www.w3.org/TR/webauthn/#relying-party-identifier) diff --git a/lib/webauthn/relying_party.rb b/lib/webauthn/relying_party.rb index 2b6db690..74503b43 100644 --- a/lib/webauthn/relying_party.rb +++ b/lib/webauthn/relying_party.rb @@ -25,7 +25,7 @@ def initialize( name: nil, verify_attestation_statement: true, verify_cross_origin: false, - credential_options_timeout: 120000, + credential_options_timeout: 300_000, silent_authentication: false, acceptable_attestation_types: ['None', 'Self', 'Basic', 'AttCA', 'Basic_or_AttCA', 'AnonCA'], attestation_root_certificates_finders: [], diff --git a/spec/webauthn/credential_creation_options_spec.rb b/spec/webauthn/credential_creation_options_spec.rb index 01a5f465..f5c52dd8 100644 --- a/spec/webauthn/credential_creation_options_spec.rb +++ b/spec/webauthn/credential_creation_options_spec.rb @@ -71,7 +71,7 @@ context "client timeout" do it "has a default client timeout" do - expect(creation_options.timeout).to(eq(120000)) + expect(creation_options.timeout).to(eq(300000)) end context "when client timeout is configured" do diff --git a/spec/webauthn/credential_request_options_spec.rb b/spec/webauthn/credential_request_options_spec.rb index 23b9f503..ada9dfc6 100644 --- a/spec/webauthn/credential_request_options_spec.rb +++ b/spec/webauthn/credential_request_options_spec.rb @@ -18,7 +18,7 @@ context "client timeout" do it "has a default client timeout" do - expect(request_options.timeout).to(eq(120000)) + expect(request_options.timeout).to(eq(300000)) end context "when client timeout is configured" do diff --git a/spec/webauthn/public_key_credential/creation_options_spec.rb b/spec/webauthn/public_key_credential/creation_options_spec.rb index 9c5ab71b..260b9366 100644 --- a/spec/webauthn/public_key_credential/creation_options_spec.rb +++ b/spec/webauthn/public_key_credential/creation_options_spec.rb @@ -76,7 +76,7 @@ context "client timeout" do it "has a default client timeout" do - expect(creation_options.timeout).to(eq(120000)) + expect(creation_options.timeout).to(eq(300000)) end context "when client timeout is configured" do @@ -147,7 +147,7 @@ expect(hash[:pubKeyCredParams]).to eq( [{ type: "public-key", alg: -7 }, { type: "public-key", alg: -37 }, { type: "public-key", alg: -257 }] ) - expect(hash[:timeout]).to eq(120_000) + expect(hash[:timeout]).to eq(300_000) expect(hash[:challenge]).to be_truthy expect(hash[:extensions]).to eq({}) expect(hash).not_to have_key(:excludeCredentials) diff --git a/spec/webauthn/public_key_credential/request_options_spec.rb b/spec/webauthn/public_key_credential/request_options_spec.rb index da03ae41..f56ca20d 100644 --- a/spec/webauthn/public_key_credential/request_options_spec.rb +++ b/spec/webauthn/public_key_credential/request_options_spec.rb @@ -18,7 +18,7 @@ context "client timeout" do it "has a default client timeout" do - expect(request_options.timeout).to(eq(120000)) + expect(request_options.timeout).to(eq(300000)) end context "when client timeout is configured" do @@ -72,7 +72,7 @@ hash = options.as_json - expect(hash[:timeout]).to eq(120_000) + expect(hash[:timeout]).to eq(300_000) expect(hash[:allowCredentials]).to eq([]) expect(hash[:extensions]).to eq({}) expect(hash[:challenge]).to be_truthy