From 1a46e23ae44763996dee3589e819b04561c56c48ce37a2b4b512692f85834139 Mon Sep 17 00:00:00 2001 From: Alexandra Knopf Date: Thu, 6 Aug 2026 06:49:58 -0700 Subject: [PATCH] check username --- README.md | 2 +- go.mod | 4 +++- go.sum | 4 ++++ main.go | 40 +++++++++++++++++++++++++++------------- store.go | 6 ++++-- web/script.js | 3 ++- 6 files changed, 41 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index 820e8c0..7994eb8 100644 --- a/README.md +++ b/README.md @@ -3,4 +3,4 @@ ## Credits - * (Go WebAuthn/Passkey Example)[https://github.com/egregors/go-passkey] + * [Go WebAuthn/Passkey Example](https://github.com/egregors/go-passkey) diff --git a/go.mod b/go.mod index 8837c08..cb6891a 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module OwOrganizer -go 1.21.7 +go 1.24.0 require ( github.com/go-webauthn/webauthn v0.10.2 @@ -8,7 +8,9 @@ require ( ) require ( + filippo.io/edwards25519 v1.2.0 // indirect github.com/fxamacker/cbor/v2 v2.6.0 // indirect + github.com/go-sql-driver/mysql v1.10.0 // indirect github.com/go-webauthn/x v0.1.9 // indirect github.com/golang-jwt/jwt/v5 v5.2.1 // indirect github.com/google/go-tpm v0.9.0 // indirect diff --git a/go.sum b/go.sum index 5889d2c..1796c86 100644 --- a/go.sum +++ b/go.sum @@ -1,9 +1,13 @@ +filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= +filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/fxamacker/cbor/v2 v2.5.0 h1:oHsG0V/Q6E/wqTS2O1Cozzsy69nqCiguo5Q1a1ADivE= github.com/fxamacker/cbor/v2 v2.5.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo= github.com/fxamacker/cbor/v2 v2.6.0 h1:sU6J2usfADwWlYDAFhZBQ6TnLFBHxgesMrQfQgk1tWA= github.com/fxamacker/cbor/v2 v2.6.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ= +github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw= +github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk= github.com/go-webauthn/webauthn v0.10.1 h1:+RFKj4yHPy282teiiy5sqTYPfRilzBpJyedrz9KsNFE= github.com/go-webauthn/webauthn v0.10.1/go.mod h1:a7BwAtrSMkeuJXtIKz433Av99nAv01pdfzB0a9xkDnI= github.com/go-webauthn/webauthn v0.10.2 h1:OG7B+DyuTytrEPFmTX503K77fqs3HDK/0Iv+z8UYbq4= diff --git a/main.go b/main.go index 2a79fe3..78d1f09 100644 --- a/main.go +++ b/main.go @@ -6,8 +6,8 @@ import ( "log" "net/http" "os" + "strings" "time" - "github.com/go-webauthn/webauthn/webauthn" ) @@ -89,7 +89,7 @@ func BeginRegistration(w http.ResponseWriter, r *http.Request) { // can we actually do not use the username at all? username, err := getUsername(r) if err != nil { - l.Printf("[ERRO] can't get user name: %s", err.Error()) + l.Printf("[ERROR] can't get user name: %s", err.Error()) panic(err) // FIXME: handle error } @@ -99,7 +99,7 @@ func BeginRegistration(w http.ResponseWriter, r *http.Request) { options, session, err := webAuthn.BeginRegistration(user) if err != nil { msg := fmt.Sprintf("can't begin registration: %s", err.Error()) - l.Printf("[ERRO] %s", msg) + l.Printf("[ERROR] %s", msg) JSONResponse(w, msg, http.StatusBadRequest) return @@ -108,7 +108,7 @@ func BeginRegistration(w http.ResponseWriter, r *http.Request) { // Make a session key and store the sessionData values t, err := datastore.GenSessionID() if err != nil { - l.Printf("[ERRO] can't generate session id: %s", err.Error()) + l.Printf("[ERROR] can't generate session id: %s", err.Error()) panic(err) // FIXME: handle error } @@ -133,7 +133,7 @@ func FinishRegistration(w http.ResponseWriter, r *http.Request) { // Get the session key from cookie sid, err := r.Cookie("sid") if err != nil { - l.Printf("[ERRO] can't get session id: %s", err.Error()) + l.Printf("[ERROR] can't get session id: %s", err.Error()) panic(err) // FIXME: handle error } @@ -141,13 +141,27 @@ func FinishRegistration(w http.ResponseWriter, r *http.Request) { // Get the session data stored from the function above session, _ := datastore.GetSession(sid.Value) // FIXME: cover invalid session - // In out example username == userID, but in real world it should be different + // In our example username == userID, but in real world it should be different user := datastore.GetOrCreateUser(string(session.UserID)) // Get the user + var username = strings.Trim(user.WebAuthnName(), " \r\n\t") + if username == "" { + l.Printf("[ERROR] SaveUser: Empty username") + msg := fmt.Sprintf("\"Error\": \"Can't finish registration: Empty username\"") + http.SetCookie(w, &http.Cookie{ + Name: "sid", + Value: "", + }) + l.Printf(msg) + JSONResponse(w, msg, http.StatusBadRequest) + + return + } + credential, err := webAuthn.FinishRegistration(user, session, r) if err != nil { msg := fmt.Sprintf("can't finish registration: %s", err.Error()) - l.Printf("[ERRO] %s", msg) + l.Printf("[ERROR] %s", msg) // clean up sid cookie http.SetCookie(w, &http.Cookie{ Name: "sid", @@ -177,7 +191,7 @@ func BeginLogin(w http.ResponseWriter, r *http.Request) { username, err := getUsername(r) if err != nil { - l.Printf("[ERRO]can't get user name: %s", err.Error()) + l.Printf("[ERROR]can't get user name: %s", err.Error()) panic(err) } @@ -186,7 +200,7 @@ func BeginLogin(w http.ResponseWriter, r *http.Request) { options, session, err := webAuthn.BeginLogin(user) if err != nil { msg := fmt.Sprintf("can't begin login: %s", err.Error()) - l.Printf("[ERRO] %s", msg) + l.Printf("[ERROR] %s", msg) JSONResponse(w, msg, http.StatusBadRequest) return @@ -195,7 +209,7 @@ func BeginLogin(w http.ResponseWriter, r *http.Request) { // Make a session key and store the sessionData values t, err := datastore.GenSessionID() if err != nil { - l.Printf("[ERRO] can't generate session id: %s", err.Error()) + l.Printf("[ERROR] can't generate session id: %s", err.Error()) panic(err) // TODO: handle error } @@ -219,7 +233,7 @@ func FinishLogin(w http.ResponseWriter, r *http.Request) { // Get the session key from cookie sid, err := r.Cookie("sid") if err != nil { - l.Printf("[ERRO] can't get session id: %s", err.Error()) + l.Printf("[ERROR] can't get session id: %s", err.Error()) panic(err) // FIXME: handle error } @@ -231,7 +245,7 @@ func FinishLogin(w http.ResponseWriter, r *http.Request) { credential, err := webAuthn.FinishLogin(user, session, r) if err != nil { - l.Printf("[ERRO] can't finish login: %s", err.Error()) + l.Printf("[ERROR] can't finish login: %s", err.Error()) panic(err) } @@ -254,7 +268,7 @@ func FinishLogin(w http.ResponseWriter, r *http.Request) { // Add the new session cookie t, err := datastore.GenSessionID() if err != nil { - l.Printf("[ERRO] can't generate session id: %s", err.Error()) + l.Printf("[ERROR] can't generate session id: %s", err.Error()) panic(err) // TODO: handle error } diff --git a/store.go b/store.go index e6a3a5d..8bcee95 100644 --- a/store.go +++ b/store.go @@ -2,8 +2,9 @@ package main import ( "crypto/rand" + "database/sql" "encoding/base64" - + "github.com/go-sql-driver/mysql" "github.com/go-webauthn/webauthn/webauthn" ) @@ -67,7 +68,8 @@ func (i *InMem) GetOrCreateUser(userName string) PasskeyUser { } func (i *InMem) SaveUser(user PasskeyUser) { + // Store user in MySQL database + i.log.Printf("[DEBUG] SaveUser: %v", user.WebAuthnName()) - i.log.Printf("[DEBUG] SaveUser: %v", user) i.users[user.WebAuthnName()] = user } diff --git a/web/script.js b/web/script.js index 3bb20ad..ca61d63 100644 --- a/web/script.js +++ b/web/script.js @@ -43,6 +43,7 @@ async function register() { const msg = await verificationResponse.json(); + console.log(msg); if (verificationResponse.ok) { showMessage(msg, false); } else { @@ -94,4 +95,4 @@ async function login() { } catch (error) { showMessage('Error: ' + error.message, true); } -} \ No newline at end of file +}