check username

main.go

@@ -6,8 +6,8 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strings"
 	"time"
-
 	"github.com/go-webauthn/webauthn/webauthn"
 )
 
@@ -89,7 +89,7 @@ func BeginRegistration(w http.ResponseWriter, r *http.Request) {
 	//  can we actually do not use the username at all?
 	username, err := getUsername(r)
 	if err != nil {
-		l.Printf("[ERRO] can't get user name: %s", err.Error())
+		l.Printf("[ERROR] can't get user name: %s", err.Error())
 
 		panic(err) // FIXME: handle error
 	}
@@ -99,7 +99,7 @@ func BeginRegistration(w http.ResponseWriter, r *http.Request) {
 	options, session, err := webAuthn.BeginRegistration(user)
 	if err != nil {
 		msg := fmt.Sprintf("can't begin registration: %s", err.Error())
-		l.Printf("[ERRO] %s", msg)
+		l.Printf("[ERROR] %s", msg)
 		JSONResponse(w, msg, http.StatusBadRequest)
 
 		return
@@ -108,7 +108,7 @@ func BeginRegistration(w http.ResponseWriter, r *http.Request) {
 	// Make a session key and store the sessionData values
 	t, err := datastore.GenSessionID()
 	if err != nil {
-		l.Printf("[ERRO] can't generate session id: %s", err.Error())
+		l.Printf("[ERROR] can't generate session id: %s", err.Error())
 
 		panic(err) // FIXME: handle error
 	}
@@ -133,7 +133,7 @@ func FinishRegistration(w http.ResponseWriter, r *http.Request) {
 	// Get the session key from cookie
 	sid, err := r.Cookie("sid")
 	if err != nil {
-		l.Printf("[ERRO] can't get session id: %s", err.Error())
+		l.Printf("[ERROR] can't get session id: %s", err.Error())
 
 		panic(err) // FIXME: handle error
 	}
@@ -141,13 +141,27 @@ func FinishRegistration(w http.ResponseWriter, r *http.Request) {
 	// Get the session data stored from the function above
 	session, _ := datastore.GetSession(sid.Value) // FIXME: cover invalid session
 
-	// In out example username == userID, but in real world it should be different
+	// In our example username == userID, but in real world it should be different
 	user := datastore.GetOrCreateUser(string(session.UserID)) // Get the user
 
+	var username = strings.Trim(user.WebAuthnName(), " \r\n\t")
+	if username == "" {
+		l.Printf("[ERROR] SaveUser: Empty username")
+		msg := fmt.Sprintf("\"Error\": \"Can't finish registration: Empty username\"")
+		http.SetCookie(w, &http.Cookie{
+			Name:  "sid",
+			Value: "",
+		})
+		l.Printf(msg)
+		JSONResponse(w, msg, http.StatusBadRequest)
+
+		return
+	}
+
 	credential, err := webAuthn.FinishRegistration(user, session, r)
 	if err != nil {
 		msg := fmt.Sprintf("can't finish registration: %s", err.Error())
-		l.Printf("[ERRO] %s", msg)
+		l.Printf("[ERROR] %s", msg)
 		// clean up sid cookie
 		http.SetCookie(w, &http.Cookie{
 			Name:  "sid",
@@ -177,7 +191,7 @@ func BeginLogin(w http.ResponseWriter, r *http.Request) {
 
 	username, err := getUsername(r)
 	if err != nil {
-		l.Printf("[ERRO]can't get user name: %s", err.Error())
+		l.Printf("[ERROR]can't get user name: %s", err.Error())
 		panic(err)
 	}
 
@@ -186,7 +200,7 @@ func BeginLogin(w http.ResponseWriter, r *http.Request) {
 	options, session, err := webAuthn.BeginLogin(user)
 	if err != nil {
 		msg := fmt.Sprintf("can't begin login: %s", err.Error())
-		l.Printf("[ERRO] %s", msg)
+		l.Printf("[ERROR] %s", msg)
 		JSONResponse(w, msg, http.StatusBadRequest)
 
 		return
@@ -195,7 +209,7 @@ func BeginLogin(w http.ResponseWriter, r *http.Request) {
 	// Make a session key and store the sessionData values
 	t, err := datastore.GenSessionID()
 	if err != nil {
-		l.Printf("[ERRO] can't generate session id: %s", err.Error())
+		l.Printf("[ERROR] can't generate session id: %s", err.Error())
 
 		panic(err) // TODO: handle error
 	}
@@ -219,7 +233,7 @@ func FinishLogin(w http.ResponseWriter, r *http.Request) {
 	// Get the session key from cookie
 	sid, err := r.Cookie("sid")
 	if err != nil {
-		l.Printf("[ERRO] can't get session id: %s", err.Error())
+		l.Printf("[ERROR] can't get session id: %s", err.Error())
 
 		panic(err) // FIXME: handle error
 	}
@@ -231,7 +245,7 @@ func FinishLogin(w http.ResponseWriter, r *http.Request) {
 
 	credential, err := webAuthn.FinishLogin(user, session, r)
 	if err != nil {
-		l.Printf("[ERRO] can't finish login: %s", err.Error())
+		l.Printf("[ERROR] can't finish login: %s", err.Error())
 		panic(err)
 	}
 
@@ -254,7 +268,7 @@ func FinishLogin(w http.ResponseWriter, r *http.Request) {
 	// Add the new session cookie
 	t, err := datastore.GenSessionID()
 	if err != nil {
-		l.Printf("[ERRO] can't generate session id: %s", err.Error())
+		l.Printf("[ERROR] can't generate session id: %s", err.Error())
 
 		panic(err) // TODO: handle error
 	}