From f52242cebf5b33f1627368ebfba12d4a47116ee4 Mon Sep 17 00:00:00 2001 From: briskt <3172830+briskt@users.noreply.github.com> Date: Wed, 17 Jul 2024 21:37:59 -0600 Subject: [PATCH] remove browser check for webauthn support --- composer.json | 1 - composer.lock | 56 +------------------ features/bootstrap/MfaContext.php | 51 ----------------- features/mfa.feature | 52 ++--------------- .../locales/en/LC_MESSAGES/material.po | 3 - .../locales/es/LC_MESSAGES/material.po | 3 - .../locales/fr/LC_MESSAGES/material.po | 3 - .../locales/ko/LC_MESSAGES/material.po | 3 - .../material/mfa/prompt-for-mfa-webauthn.twig | 20 ++----- modules/mfa/public/prompt-for-mfa.php | 5 +- modules/mfa/src/Auth/Process/Mfa.php | 39 +++---------- modules/mfa/src/LoginBrowser.php | 42 -------------- 12 files changed, 22 insertions(+), 256 deletions(-) delete mode 100644 modules/mfa/src/LoginBrowser.php diff --git a/composer.json b/composer.json index e9b88a13..dfc09fc5 100644 --- a/composer.json +++ b/composer.json @@ -22,7 +22,6 @@ "silinternational/psr3-adapters": "v4.0.0", "silinternational/yii2-json-log-targets": "^2.0", "silinternational/idp-id-broker-php-client": "^4.3", - "sinergi/browser-detector": "^6.1", "yiisoft/yii2": "~2.0.12", "yiisoft/yii2-gii": "^2.0", "google/recaptcha": "^1.1", diff --git a/composer.lock b/composer.lock index 0029c94e..7475a745 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "a4096531caaadf1c30b8c7600e11a4e1", + "content-hash": "8651bf4f51a0277e5ee442729447f5ff", "packages": [ { "name": "aws/aws-crt-php", @@ -3446,60 +3446,6 @@ }, "time": "2024-06-12T21:08:27+00:00" }, - { - "name": "sinergi/browser-detector", - "version": "6.1.4", - "source": { - "type": "git", - "url": "https://github.com/sinergi/php-browser-detector.git", - "reference": "4927f7c2bedc48b68f183bd420aa3549c59e133b" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/sinergi/php-browser-detector/zipball/4927f7c2bedc48b68f183bd420aa3549c59e133b", - "reference": "4927f7c2bedc48b68f183bd420aa3549c59e133b", - "shasum": "" - }, - "require": { - "php": ">=7.2" - }, - "require-dev": { - "phpunit/phpunit": "^8.0 || ^9.4" - }, - "type": "library", - "autoload": { - "psr-4": { - "Sinergi\\BrowserDetector\\": "src" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Gabriel Bull", - "email": "me@gabrielbull.com" - }, - { - "name": "Chris Schuld" - } - ], - "description": "Detecting the user's browser, operating system and language.", - "keywords": [ - "browser", - "detection", - "language", - "operating system", - "os" - ], - "support": { - "issues": "https://github.com/sinergi/php-browser-detector/issues", - "source": "https://github.com/sinergi/php-browser-detector/tree/6.1.4" - }, - "abandoned": true, - "time": "2021-09-23T13:51:44+00:00" - }, { "name": "symfony/cache", "version": "v6.4.8", diff --git a/features/bootstrap/MfaContext.php b/features/bootstrap/MfaContext.php index 3a5ab1bb..e0d1c794 100644 --- a/features/bootstrap/MfaContext.php +++ b/features/bootstrap/MfaContext.php @@ -2,20 +2,15 @@ use Behat\Mink\Element\DocumentElement; use Behat\Mink\Element\NodeElement; -use Behat\Mink\Exception\ElementNotFoundException; use PHPUnit\Framework\Assert; use Sil\PhpEnv\Env; use Sil\SspBase\Features\fakes\FakeIdBrokerClient; -use SimpleSAML\Module\mfa\LoginBrowser; /** * Defines application features from the specific context. */ class MfaContext extends FeatureContext { - const USER_AGENT_WITHOUT_WEBAUTHN_SUPPORT = 'Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko'; - const USER_AGENT_WITH_WEBAUTHN_SUPPORT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36'; - /** * Assert that the given page has a form that contains the given text. * @@ -433,20 +428,6 @@ public function iProvideCredentialsThatHaveUf() $this->iProvideCredentialsThatNeedMfaAndHaveUfAvailable(); } - /** - * @Given the user's browser supports WebAuthn - */ - public function theUsersBrowserSupportsUf() - { - $userAgentWithWebAuthn = self::USER_AGENT_WITH_WEBAUTHN_SUPPORT; - Assert::assertTrue( - LoginBrowser::supportsWebAuthn($userAgentWithWebAuthn), - 'Update USER_AGENT_WITH_WEBAUTHN_SUPPORT to a User Agent with WebAuthn support' - ); - -// $this->driver->getClient()->setServerParameter('HTTP_USER_AGENT', $userAgentWithWebAuthn); - } - /** * @Given I provide credentials that have WebAuthn, TOTP */ @@ -567,38 +548,6 @@ public function IHaveMoreRecentlyUsedBackupCode() $this->password = 'a'; } - /** - * @Given the user's browser does not support WebAuthn - */ - public function theUsersBrowserDoesNotSupportUf() - { - $userAgentWithoutWebAuthn = self::USER_AGENT_WITHOUT_WEBAUTHN_SUPPORT; - Assert::assertFalse( - LoginBrowser::supportsWebAuthn($userAgentWithoutWebAuthn), - 'Update USER_AGENT_WITHOUT_WEBAUTHN_SUPPORT to a User Agent without WebAuthn support' - ); - -// $this->driver->getClient()->setServerParameter('HTTP_USER_AGENT', $userAgentWithoutWebAuthn); - } - - /** - * @Then I should not see an error message about WebAuthn being unsupported - */ - public function iShouldNotSeeAnErrorMessageAboutUfBeingUnsupported() - { - $page = $this->session->getPage(); - Assert::assertNotContains('USB Security Keys are not supported', $page->getContent()); - } - - /** - * @Then I should see an error message about WebAuthn being unsupported - */ - public function iShouldSeeAnErrorMessageAboutUfBeingUnsupported() - { - $page = $this->session->getPage(); - Assert::assertContains('USB Security Keys are not supported', $page->getContent()); - } - /** * @Given the user has a manager email */ diff --git a/features/mfa.feature b/features/mfa.feature index 4486f381..3334d48d 100644 --- a/features/mfa.feature +++ b/features/mfa.feature @@ -35,7 +35,6 @@ Feature: Prompt for MFA credentials Scenario: Needs MFA, has WebAuthn option available Given I provide credentials that need MFA and have WebAuthn available - And the user's browser supports WebAuthn When I log in Then I should see a prompt for a WebAuthn security key @@ -126,65 +125,24 @@ Feature: Prompt for MFA credentials When I click the remind-me-later button Then I should end up at my intended destination - Scenario Outline: Defaulting to another option when WebAuthn is not supported - Given I provide credentials that have - And the user's browser - When I log in - Then I should see a prompt for a - - Examples: - | WebAuthn? | TOTP? | backup codes? | supports WebAuthn or not | default MFA type | - | WebAuthn | | | supports WebAuthn | WebAuthn | - | WebAuthn | , TOTP | | supports WebAuthn | WebAuthn | - | WebAuthn | | , backup codes | supports WebAuthn | WebAuthn | - | WebAuthn | , TOTP | , backup codes | supports WebAuthn | WebAuthn | - | | TOTP | | supports WebAuthn | TOTP | - | | TOTP | , backup codes | supports WebAuthn | TOTP | - | | | backup codes | supports WebAuthn | backup code | -# The following cases are disabled due to lack of test support for changing web client user agent -# | WebAuthn | | | does not support WebAuthn | WebAuthn | -# | WebAuthn | , TOTP | | does not support WebAuthn | TOTP | -# | WebAuthn | | , backup codes | does not support WebAuthn | backup code | -# | WebAuthn | , TOTP | , backup codes | does not support WebAuthn | TOTP | -# | | TOTP | | does not support WebAuthn | TOTP | -# | | TOTP | , backup codes | does not support WebAuthn | TOTP | -# | | | backup codes | does not support WebAuthn | backup code | - - Scenario Outline: Defaulting to the most recently used mfa option Given I provide credentials that have a used And and I have a more recently used - And the user's browser When I log in Then I should see a prompt for a Examples: - | MFA type | recent MFA type | supports WebAuthn or not | default MFA type | - | WebAuthn | TOTP | supports WebAuthn | TOTP | - | TOTP | WebAuthn | supports WebAuthn | WebAuthn | - | TOTP | backup code | supports WebAuthn | backup code | - | backup code | TOTP | supports WebAuthn | TOTP | -# The following case is disabled due to lack of test support for changing web client user agent -# | TOTP | WebAuthn | does not support WebAuthn | TOTP | + | MFA type | recent MFA type | default MFA type | + | WebAuthn | TOTP | TOTP | + | TOTP | WebAuthn | WebAuthn | + | TOTP | backup code | backup code | + | backup code | TOTP | TOTP | Scenario: Defaulting to the manager code despite having a used mfa Given I provide credentials that have a manager code, a WebAuthn and a more recently used TOTP - And the user's browser supports WebAuthn When I log in Then I should see a prompt for a manager rescue code - Scenario Outline: When to show the WebAuthn-not-supported error message - Given I provide credentials that have WebAuthn - And the user's browser - When I log in - Then I see an error message about WebAuthn being unsupported - - Examples: - | supports WebAuthn or not | should or not | - | supports WebAuthn | should not | -# The following case is disabled due to lack of test support for changing web client user agent -# | does not support WebAuthn | should | - Scenario Outline: When to show the link to send a manager rescue code Given I provide credentials that have And the user a manager email diff --git a/modules/material/locales/en/LC_MESSAGES/material.po b/modules/material/locales/en/LC_MESSAGES/material.po index 465a43e4..ff452efb 100644 --- a/modules/material/locales/en/LC_MESSAGES/material.po +++ b/modules/material/locales/en/LC_MESSAGES/material.po @@ -137,9 +137,6 @@ msgstr "USB key icon" msgid "{mfa:webauthn_instructions}" msgstr "You may now insert your security key and press its button." -msgid "{mfa:webauthn_unsupported}" -msgstr "Unsupported in your current browser. Please consider a more secure browser like Google Chrome." - msgid "{mfa:webauthn_error_unknown}" msgstr "Something went wrong with that request, unable to verify at this time." diff --git a/modules/material/locales/es/LC_MESSAGES/material.po b/modules/material/locales/es/LC_MESSAGES/material.po index 2c8fcbb1..2b636e8b 100644 --- a/modules/material/locales/es/LC_MESSAGES/material.po +++ b/modules/material/locales/es/LC_MESSAGES/material.po @@ -137,9 +137,6 @@ msgstr "Icono de la llave USB" msgid "{mfa:webauthn_instructions}" msgstr "Ahora puede insertar su clave de seguridad y presionar su botón." -msgid "{mfa:webauthn_unsupported}" -msgstr "No compatible en su navegador actual. Considere un navegador más seguro como Google Chrome." - msgid "{mfa:webauthn_error_unknown}" msgstr "Algo salió mal con esa solicitud, no se pudo verificar en este momento." diff --git a/modules/material/locales/fr/LC_MESSAGES/material.po b/modules/material/locales/fr/LC_MESSAGES/material.po index 579721c7..3bc51ad6 100644 --- a/modules/material/locales/fr/LC_MESSAGES/material.po +++ b/modules/material/locales/fr/LC_MESSAGES/material.po @@ -137,9 +137,6 @@ msgstr "Icône de clé USB" msgid "{mfa:webauthn_instructions}" msgstr "Vous pouvez maintenant insérer votre clé de sécurité et appuyer sur le bouton." -msgid "{mfa:webauthn_unsupported}" -msgstr "Non compatible avec votre navigateur actuel. Veuillez considérer un navigateur plus sûr comme Google Chrome." - msgid "{mfa:webauthn_error_unknown}" msgstr "Quelque chose s'est mal passé avec cette demande, impossible de vérifier pour le moment." diff --git a/modules/material/locales/ko/LC_MESSAGES/material.po b/modules/material/locales/ko/LC_MESSAGES/material.po index 7cb18c09..2cf61259 100644 --- a/modules/material/locales/ko/LC_MESSAGES/material.po +++ b/modules/material/locales/ko/LC_MESSAGES/material.po @@ -137,9 +137,6 @@ msgstr "USB 키 아이콘" msgid "{mfa:webauthn_instructions}" msgstr "이제 보안 키를 삽입하고 단추를 누를 수 있습니다." -msgid "{mfa:webauthn_unsupported}" -msgstr "현재 브라우저에서 지원되지 않습니다. Chrome과 같은 보다 안전한 브라우저를 고려하십시오." - msgid "{mfa:webauthn_error_unknown}" msgstr "요청에 문제가 발생하여 지금은 확인할 수 없습니다." diff --git a/modules/material/themes/material/mfa/prompt-for-mfa-webauthn.twig b/modules/material/themes/material/mfa/prompt-for-mfa-webauthn.twig index 0e0680e1..b8123e78 100644 --- a/modules/material/themes/material/mfa/prompt-for-mfa-webauthn.twig +++ b/modules/material/themes/material/mfa/prompt-for-mfa-webauthn.twig @@ -65,7 +65,7 @@ - +
@@ -88,19 +88,11 @@
- {% if supports_web_authn %} -
-

- {{ '{mfa:webauthn_instructions}'|trans }} -

-
- {% else %} -
-

- {{ '{mfa:webauthn_unsupported}'|trans|raw }} -

-
- {% endif %} +
+

+ {{ '{mfa:webauthn_instructions}'|trans }} +

+
{% if error_message is not empty %}