Skip to content

Instantly share code, notes, and snippets.

@vbkmr
Last active August 1, 2022 09:07
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save vbkmr/06ab7b6009b384da827b3329ffb1dfe8 to your computer and use it in GitHub Desktop.
Save vbkmr/06ab7b6009b384da827b3329ffb1dfe8 to your computer and use it in GitHub Desktop.
FIDO

WORKSHOP: Authenticating your web like a boss

https://slides.com/fidoalliance/jan-2018-fido-seminar-webauthn-tutorial#/5/0/4

For registration:

Get username and name(password field is obsolete, lol) Send them to the server Server responds with challenge MakeCredential Send response to the server Check that server likes it PROFIT!

https://youtu.be/aMo4ZlWznao

https://webauthn.guide/#webauthn-api

FIDO sequence diagram https://developers.yubico.com/WebAuthn/Libraries/Using_a_library.html

{
    "result": "OK",
    "data": {
        "id": 321843473,
        "name": "vb",
        "photo_url": "https://static-panda-jp.dev5s.com/images/member_photo_noimage.png",
        "photo_thumbnail_url": "https://static-panda-jp.dev5s.com/images/member_photo_noimage_thumb.png",
        "created": 1656661467,
        "proper": true,
        "email": "v-kumar+1@mercari.com",
        "phone_number": "TEST_USER",
        "num_ticket": 0,
        "introduction": "",
        "iv_code": "PVGHPN",
        "is_official": false,
        "num_sell_items": 0,
        "bounce_mail_flag": "no",
        "register_sms_confirmation": "yes",
        "register_sms_confirmation_at": "2022-07-01 16:44:27",
        "ratings": {
            "good": 0,
            "normal": 0,
            "bad": 0
        },
        "num_ratings": 0,
        "score": 0,
        "incentive_credit": 0,
        "incentive_type": 0,
        "attributes": {},
        "poa": "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6IjMifQ.eyJpc3MiOiJtZXJjYXJpLWFwaS1qcCIsImF1ZCI6WyJtZXJjYXJpLWF1dGhvcml0eSIsImh0dHBzOlwvXC9hdXRoLXRlc3QuZGV2NXMuY29tXC9qcFwvdjFcL3Rva2VuIiwiaHR0cHM6XC9cL2F1dGgtZGV2LmRldjVzLmNvbVwvanBcL3YxXC90b2tlbiIsImh0dHBzOlwvXC9hdXRoLXNhbmRib3guZGV2NXMuY29tXC9qcFwvdjFcL3Rva2VuIl0sInN1YiI6Im1lcmNhcmk6MzIxODQzNDczIiwiaWF0IjoxNjU2NjYxNDY3LCJleHAiOjE2NTY2NjIwNjcsImFtciI6WyJtZXJjYXJpIl0sImp0aSI6IjA1OWEzNjBmLTU3YzAtNGQxOS1iNDllLWU0Y2FkOWE5Zjk5MSIsImF1dGhfaWQiOiI0NWUwZWNkYS05Y2IwLTRlMmUtYjk5NS02ZGExM2EzZjRiYWIiLCJhdXRoX3RpbWUiOjE2NTY2NjE0Njd9.0Ac67vwk8xGOiQtHbWEQg9JUGOgNpFRHSOIQjVvHTAJC2sSK7btunntcULxsGzj1YVp07l0y946tXYV67RFM5g"
    },
    "meta": {
        "requested": 1656661467,
        "exec_time": 0.721255
    }
}
curl -i -X POST https://accounts.dev5s.com/jp/v1/registration/webauthn/options -H "Authorization: 2:8db2177a7e0956cbb9fce8315a555dd150766df394342cec34ddf719993c101c" -H "Content-Type: application/json" -H "service-router-user-account-test-kouzoh-user-account-jp-dev: user-account-test-pr907.kouzoh-user-account-jp-dev" -d '{"rpid": "suruga.dev5s.com", "key_name":"test", "user_name": "vb", "display_name": "vb", "timeout": 1000}'
curl -i -X POST https://accounts.dev5s.com/jp/v1/registration/webauthn/result -H "Authorization: 2:8db2177a7e0956cbb9fce8315a555dd150766df394342cec34ddf719993c101c" -H "Content-Type: application/json" -H "service-router-user-account-test-kouzoh-user-account-jp-dev: user-account-test-pr907.kouzoh-user-account-jp-dev" -H "service-router-merpaygatewayjp-test-merpay-gateway-jp-dev: merpaygatewayjp-test-qa-2.merpay-gateway-jp-dev" -d '{"response":{"client_data_json":"eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoid19kSTdvZHNhekd5ODdDMVhnNm1CZHhhNHlObDRkb3pPZ3FjWnhDUFpXMCIsIm9yaWdpbiI6Imh0dHBzOi8vcHIuc3VydWdhLmRldjVzLmNvbSIsImNyb3NzT3JpZ2luIjpmYWxzZX0=","attestation_object":"o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEcwRQIgavSriLPTyQKD6J8Ggr2R8s4c1OCwYPdddvVrXdm9JaoCIQDSk/C5Oj5zjrjXXN5hYj9kBZvJ46EdSO2LTD/vW01f2GhhdXRoRGF0YVj1f8jmlQdXFjNQpQDPyecVR1jPe+M3xfj+JQQNYfLjeNxFAAAAAK3OAAI1vMYKZIsLJfHwVQMAcZnlYFO++B1ttPz8trYVr0p90C9KlgBUppFAXnVFX0zq+v7S8iq5n3r1qNApSyw4IsibpKD296AzmQnwYNhbPfnl7MkJlNQqDOHEz0MuyvKj+W5YMJU9A76iAZj4sL8S+hfX3ei2xO2cNFq/px/uuYndpQECAyYgASFYILO40n4lPPsgNXTeHIvO+u/M74AtU6Fujd05b5v9J3hDIlggPLRmWTt37K51noQ2n0Kf12ADWbI/hnnOZqoNm6313JI="},"id":"meVgU774HW20_Py2thWvSn3QL0qWAFSmkUBedUVfTOr6_tLyKrmfevWo0ClLLDgiyJukoPb3oDOZCfBg2Fs9-eXsyQmU1CoM4cTPQy7K8qP5blgwlT0DvqIBmPiwvxL6F9fd6LbE7Zw0Wr-nH-65id0","raw_id":"meVgU774HW20/Py2thWvSn3QL0qWAFSmkUBedUVfTOr6/tLyKrmfevWo0ClLLDgiyJukoPb3oDOZCfBg2Fs9+eXsyQmU1CoM4cTPQy7K8qP5blgwlT0DvqIBmPiwvxL6F9fd6LbE7Zw0Wr+nH+65id0=","type":"public-key"}'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment