dom/webauthn/tests/test_webauthn_make_credential.html

   1 <!DOCTYPE html>
   2 <meta charset=utf-8>
   3 <head>
   4   <title>Test for MakeCredential for W3C Web Authentication</title>
   5   <script src="/tests/SimpleTest/SimpleTest.js"></script>
   6   <script type="text/javascript" src="u2futil.js"></script>
   7   <script type="text/javascript" src="pkijs/common.js"></script>
   8   <script type="text/javascript" src="pkijs/asn1.js"></script>
   9   <script type="text/javascript" src="pkijs/x509_schema.js"></script>
  10   <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
  11   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
  12 </head>
  13 <body>
  14
  15   <h1>Test for MakeCredential for W3C Web Authentication</h1>
  16   <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
  17
  18   <script class="testbody" type="text/javascript">
  19     "use strict";
  20
  21     add_task(async () => {
  22       await addVirtualAuthenticator();
  23     });
  24
  25     is(navigator.authentication, undefined, "navigator.authentication does not exist any longer");
  26     isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
  27     isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
  28     isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
  29
  30     let credm;
  31     let gCredentialChallenge;
  32     let rp;
  33     let user;
  34     let param;
  35     let unsupportedParam;
  36     let unknownParam;
  37
  38     // Setup test env
  39     add_task(() => {
  40       gCredentialChallenge = new Uint8Array(16);
  41       window.crypto.getRandomValues(gCredentialChallenge);
  42
  43       rp = {id: document.domain, name: "none"};
  44       user = {id: new Uint8Array(64), name: "none", displayName: "none"};
  45       param = {type: "public-key", alg: cose_alg_ECDSA_w_SHA256};
  46       unsupportedParam = {type: "public-key", alg: cose_alg_ECDSA_w_SHA512};
  47       unknownParam = {type: "SimplePassword", alg: "MaxLength=2"};
  48       credm = navigator.credentials;
  49     });
  50     // Add tests
  51     add_task(test_good_call);
  52     add_task(test_empty_account);
  53     add_task(test_without_rp_name);
  54     add_task(test_without_user_id);
  55     add_task(test_without_user_name);
  56     add_task(test_without_user_displayname);
  57     add_task(test_user_too_large);
  58     add_task(test_empty_parameters);
  59     add_task(test_without_parameters);
  60     add_task(test_unsupported_parameter);
  61     add_task(test_unsupported_but_one_param);
  62     add_task(test_one_unknown_parameter);
  63     add_task(test_one_unknown_one_unsupported_param);
  64     add_task(test_one_of_each_parameters);
  65     add_task(test_without_challenge);
  66     add_task(test_invalid_challenge);
  67     add_task(test_duplicate_pub_key);
  68     add_task(test_invalid_rp_id);
  69     add_task(test_invalid_rp_id_2);
  70     add_task(test_missing_rp);
  71     add_task(test_incorrect_user_id_type);
  72     add_task(test_missing_user);
  73     add_task(test_complete_account);
  74     add_task(test_too_large_user_id);
  75     add_task(test_excluding_unknown_transports);
  76     add_task(test_unknown_attestation_type);
  77     add_task(test_unknown_selection_criteria);
  78     add_task(test_no_unexpected_extensions);
  79     add_task(test_cred_props_with_rk_required);
  80     add_task(test_cred_props_with_rk_discouraged);
  81
  82     function arrivingHereIsGood(aResult) {
  83       ok(true, "Good result! Received a: " + aResult);
  84       return Promise.resolve();
  85     }
  86
  87     function arrivingHereIsBad(aResult) {
  88       ok(false, "Bad result! Received a: " + aResult);
  89       return Promise.resolve();
  90     }
  91
  92     function expectNotAllowedError(aResult) {
  93       ok(aResult.toString().startsWith("NotAllowedError"), "Expecting a NotAllowedError");
  94       return Promise.resolve();
  95     }
  96
  97     function expectTypeError(aResult) {
  98       ok(aResult.toString().startsWith("TypeError"), "Expecting a TypeError");
  99       return Promise.resolve();
 100     }
 101
 102     function expectNotSupportedError(aResult) {
 103       ok(aResult.toString().startsWith("NotSupportedError"), "Expecting a NotSupportedError");
 104       return Promise.resolve();
 105     }
 106
 107     // Test basic good call
 108     async function test_good_call() {
 109       let makeCredentialOptions = {
 110         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 111       };
 112       return credm.create({publicKey: makeCredentialOptions})
 113                   .then(arrivingHereIsGood)
 114                   .catch(arrivingHereIsBad);
 115     }
 116
 117     // Test empty account
 118     async function test_empty_account() {
 119       let makeCredentialOptions = {
 120         challenge: gCredentialChallenge, pubKeyCredParams: [param]
 121       };
 122       return credm.create({publicKey: makeCredentialOptions})
 123                   .then(arrivingHereIsBad)
 124                   .catch(expectTypeError);
 125     }
 126
 127     // Test without rp.name
 128     async function test_without_rp_name() {
 129       let rp1 = {id: document.domain};
 130       let makeCredentialOptions = {
 131         rp: rp1, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 132       };
 133       return credm.create({publicKey: makeCredentialOptions})
 134                   .then(arrivingHereIsBad)
 135                   .catch(expectTypeError);
 136     }
 137
 138     // Test without user.id
 139     async function test_without_user_id() {
 140       let user1 = {name: "none", displayName: "none"};
 141       let makeCredentialOptions = {
 142         rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 143       };
 144       return credm.create({publicKey: makeCredentialOptions})
 145                   .then(arrivingHereIsBad)
 146                   .catch(expectTypeError);
 147     }
 148
 149     // Test without user.name
 150     async function test_without_user_name() {
 151       let user1 = {id: new Uint8Array(64), displayName: "none"};
 152       let makeCredentialOptions = {
 153         rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 154       };
 155       return credm.create({publicKey: makeCredentialOptions})
 156                   .then(arrivingHereIsBad)
 157                   .catch(expectTypeError);
 158     }
 159
 160     // Test without user.displayName
 161     async function test_without_user_displayname() {
 162       let user1 = {id: new Uint8Array(64), name: "none"};
 163       let makeCredentialOptions = {
 164         rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 165       };
 166       return credm.create({publicKey: makeCredentialOptions})
 167                   .then(arrivingHereIsBad)
 168                   .catch(expectTypeError);
 169     }
 170
 171     // Test with a user handle that exceeds the max length
 172     async function test_user_too_large() {
 173       let user1 = {id: new Uint8Array(65), name: "none", displayName: "none"};
 174       let makeCredentialOptions = {
 175         rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 176       };
 177       return credm.create({publicKey: makeCredentialOptions})
 178                   .then(arrivingHereIsBad)
 179                   .catch(expectTypeError);
 180     }
 181
 182     // Test without any parameters; this is acceptable meaning the RP ID is
 183     // happy to accept either ECDSA-SHA256 or RSA-SHA256
 184     async function test_empty_parameters() {
 185       let makeCredentialOptions = {
 186         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: []
 187       };
 188       return credm.create({publicKey: makeCredentialOptions})
 189                   .then(arrivingHereIsGood)
 190                   .catch(arrivingHereIsBad);
 191     }
 192
 193     // Test without a parameter array at all
 194     async function test_without_parameters() {
 195       let makeCredentialOptions = {
 196         rp, user, challenge: gCredentialChallenge
 197       };
 198       return credm.create({publicKey: makeCredentialOptions})
 199            .then(arrivingHereIsBad)
 200            .catch(expectTypeError);
 201     }
 202
 203     // Test with an unsupported parameter
 204     // The result depends on the tokens that are available, so we
 205     // expect a NotAllowedError so as not to leak this.
 206     async function test_unsupported_parameter() {
 207       let makeCredentialOptions = {
 208         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [unsupportedParam]
 209       };
 210       return credm.create({publicKey: makeCredentialOptions})
 211                   .then(arrivingHereIsBad)
 212                   .catch(expectNotAllowedError);
 213     }
 214
 215     // Test with an unsupported parameter and a good one
 216     async function test_unsupported_but_one_param() {
 217       let makeCredentialOptions = {
 218         rp, user, challenge: gCredentialChallenge,
 219         pubKeyCredParams: [param, unsupportedParam]
 220       };
 221       return credm.create({publicKey: makeCredentialOptions})
 222                   .then(arrivingHereIsGood)
 223                   .catch(arrivingHereIsBad);
 224     }
 225
 226     // Test with one unknown (not "public-key") parameter.
 227     async function test_one_unknown_parameter() {
 228       let makeCredentialOptions = {
 229         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [unknownParam]
 230       };
 231       return credm.create({publicKey: makeCredentialOptions})
 232            .then(arrivingHereIsBad)
 233            .catch(expectNotSupportedError);
 234     }
 235
 236     // Test with an unsupported parameter, and an unknown one
 237     // The result depends on the tokens that are available, so we
 238     // expect a NotAllowedError so as not to leak this.
 239     async function test_one_unknown_one_unsupported_param() {
 240       let makeCredentialOptions = {
 241         rp, user, challenge: gCredentialChallenge,
 242         pubKeyCredParams: [unsupportedParam, unknownParam]
 243       };
 244       return credm.create({publicKey: makeCredentialOptions})
 245                   .then(arrivingHereIsBad)
 246                   .catch(expectNotAllowedError);
 247     }
 248
 249     // Test with an unsupported parameter, an unknown one, and a good one. This
 250     // should succeed, as the unsupported and unknown should be ignored.
 251     async function test_one_of_each_parameters() {
 252       let makeCredentialOptions = {
 253         rp, user, challenge: gCredentialChallenge,
 254         pubKeyCredParams: [param, unsupportedParam, unknownParam]
 255       };
 256       return credm.create({publicKey: makeCredentialOptions})
 257                   .then(arrivingHereIsGood)
 258                   .catch(arrivingHereIsBad);
 259     }
 260
 261     // Test without a challenge
 262     async function test_without_challenge() {
 263       let makeCredentialOptions = {
 264         rp, user, pubKeyCredParams: [param]
 265       };
 266       return credm.create({publicKey: makeCredentialOptions})
 267                   .then(arrivingHereIsBad)
 268                   .catch(expectTypeError);
 269     }
 270
 271     // Test with an invalid challenge
 272     async function test_invalid_challenge() {
 273       let makeCredentialOptions = {
 274         rp, user, challenge: "begone, thou ill-fitting moist glove!",
 275         pubKeyCredParams: [unsupportedParam]
 276       };
 277       return credm.create({publicKey: makeCredentialOptions})
 278            .then(arrivingHereIsBad)
 279            .catch(expectTypeError);
 280     }
 281
 282     // Test with duplicate pubKeyCredParams
 283     async function test_duplicate_pub_key() {
 284       let makeCredentialOptions = {
 285         rp, user, challenge: gCredentialChallenge,
 286         pubKeyCredParams: [param, param, param]
 287       };
 288       return credm.create({publicKey: makeCredentialOptions})
 289                   .then(arrivingHereIsGood)
 290                   .catch(arrivingHereIsBad);
 291     }
 292
 293     // Test with an RP ID that is not a valid domain string
 294     async function test_invalid_rp_id() {
 295       let rp1 = { id: document.domain + ":somejunk", name: "none"};
 296       let makeCredentialOptions = {
 297         rp: rp1, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 298       };
 299       return credm.create({publicKey: makeCredentialOptions})
 300                   .then(arrivingHereIsBad)
 301                   .catch(arrivingHereIsGood);
 302     }
 303
 304     // Test with another RP ID that is not a valid domain string
 305     async function test_invalid_rp_id_2() {
 306       let rp1 = { id: document.domain + ":8888", name: "none"};
 307       let makeCredentialOptions = {
 308         rp: rp1, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 309       };
 310       return credm.create({publicKey: makeCredentialOptions})
 311                   .then(arrivingHereIsBad)
 312                   .catch(arrivingHereIsGood);
 313     }
 314
 315     // Test with missing rp
 316     async function test_missing_rp() {
 317       let makeCredentialOptions = {
 318         user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 319       };
 320       return credm.create({publicKey: makeCredentialOptions})
 321                   .then(arrivingHereIsBad)
 322                   .catch(expectTypeError);
 323     }
 324
 325     // Test with incorrect user ID type
 326     async function test_incorrect_user_id_type() {
 327       let invalidType = {id: "a string, which is not a buffer", name: "none", displayName: "none"};
 328       let makeCredentialOptions = {
 329         user: invalidType, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 330       };
 331       return credm.create({publicKey: makeCredentialOptions})
 332                   .then(arrivingHereIsBad)
 333                   .catch(expectTypeError);
 334     }
 335
 336     // Test with missing user
 337     async function test_missing_user() {
 338       let makeCredentialOptions = {
 339         rp, challenge: gCredentialChallenge, pubKeyCredParams: [param]
 340       };
 341       return credm.create({publicKey: makeCredentialOptions})
 342                   .then(arrivingHereIsBad)
 343                   .catch(expectTypeError);
 344     }
 345
 346     // Test a complete account
 347     async function test_complete_account() {
 348       // the icon fields are deprecated, but including them should not cause an error
 349       let completeRP = {id: document.domain, name: "Foxxy Name",
 350                         icon: "https://example.com/fox.svg"};
 351       let completeUser = {id: string2buffer("foxes_are_the_best@example.com"),
 352                           name: "Fox F. Foxington",
 353                           icon: "https://example.com/fox.svg",
 354                           displayName: "Foxxy V"};
 355       let makeCredentialOptions = {
 356         rp: completeRP, user: completeUser, challenge: gCredentialChallenge,
 357         pubKeyCredParams: [param]
 358       };
 359       return credm.create({publicKey: makeCredentialOptions})
 360                   .then(arrivingHereIsGood)
 361                   .catch(arrivingHereIsBad);
 362     }
 363
 364     // Test with too-large user ID buffer
 365     async function test_too_large_user_id() {
 366       let hugeUser = {id: new Uint8Array(65),
 367                           name: "Fox F. Foxington",
 368                           displayName: "Foxxy V"};
 369       let makeCredentialOptions = {
 370         rp, user: hugeUser, challenge: gCredentialChallenge,
 371         pubKeyCredParams: [param]
 372       };
 373       return credm.create({publicKey: makeCredentialOptions})
 374                   .then(arrivingHereIsBad)
 375                   .catch(expectTypeError);
 376     }
 377
 378     // Test with excluding unknown transports
 379     async function test_excluding_unknown_transports() {
 380       let completeRP = {id: document.domain, name: "Foxxy Name"};
 381       let completeUser = {id: string2buffer("foxes_are_the_best@example.com"),
 382                           name: "Fox F. Foxington",
 383                           displayName: "Foxxy V"};
 384       let excludedUnknownTransport = {type: "public-key",
 385                                       id: string2buffer("123"),
 386                                       transports: ["unknown", "usb"]};
 387       let makeCredentialOptions = {
 388         rp: completeRP, user: completeUser, challenge: gCredentialChallenge,
 389         pubKeyCredParams: [param], excludeCredentials: [excludedUnknownTransport]
 390       };
 391       return credm.create({publicKey: makeCredentialOptions})
 392                   .then(arrivingHereIsGood)
 393                   .catch(arrivingHereIsBad);
 394     }
 395
 396     async function test_unknown_attestation_type() {
 397       let makeCredentialOptions = {
 398         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param],
 399         attestation: "unknown"
 400       };
 401       return credm.create({publicKey: makeCredentialOptions })
 402                   .then(arrivingHereIsGood)
 403                   .catch(arrivingHereIsBad);
 404     }
 405
 406     async function test_unknown_selection_criteria() {
 407       let makeCredentialOptions = {
 408         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param],
 409             authenticatorSelection: {
 410                   userVerificationRequirement: "unknown UV requirement",
 411                   authenticatorAttachment: "unknown authenticator attachment type"
 412             },
 413       };
 414       return credm.create({publicKey: makeCredentialOptions })
 415                   .then(arrivingHereIsGood)
 416                   .catch(arrivingHereIsBad);
 417     }
 418
 419     async function test_no_unexpected_extensions() {
 420       let makeCredentialOptions = {
 421         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param],
 422       };
 423       let cred = await credm.create({publicKey: makeCredentialOptions}).catch(arrivingHereIsBad);
 424       let extensionResults = cred.getClientExtensionResults();
 425       is(extensionResults.credProps, undefined, "no credProps output");
 426     }
 427
 428     async function test_cred_props_with_rk_required() {
 429       let makeCredentialOptions = {
 430         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param],
 431             authenticatorSelection: {
 432                   authenticatorAttachment: "cross-platform",
 433                   residentKey: "required",
 434             },
 435             extensions: { credProps: true }
 436       };
 437       let cred = await credm.create({publicKey: makeCredentialOptions}).catch(arrivingHereIsBad);
 438       let extensionResults = cred.getClientExtensionResults();
 439       is(extensionResults.credProps?.rk, true, "rk is true");
 440     }
 441
 442     async function test_cred_props_with_rk_discouraged() {
 443       let makeCredentialOptions = {
 444         rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param],
 445             authenticatorSelection: {
 446                   authenticatorAttachment: "cross-platform",
 447                   residentKey: "discouraged",
 448             },
 449             extensions: { credProps: true }
 450       };
 451       let cred = await credm.create({publicKey: makeCredentialOptions}).catch(arrivingHereIsBad);
 452       let extensionResults = cred.getClientExtensionResults();
 453       is(extensionResults.credProps?.rk, false, "rk is false");
 454     }
 455
 456   </script>
 457
 458 </body>
 459 </html>