docs(security): say what backs the single-use assertion claim - #228
Merged
Conversation
The ephemeral token entry argues that a leaked token cannot be exchanged for anything on its own, because the continuation step still requires an OTP code, a magic link token or a WebAuthn assertion. That reasoning depends on the continuation credential being single use, and the entry never said what makes the assertion one. It now points at the challenge store: the challenge lives in webauthn_challenges with a server-enforced TTL and a per-flow purpose, and consumeChallenge spends it on read, before verification, so no outcome leaves a challenge behind to replay an assertion against. Documentation only. This states what the code already does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ephemeral token replay entry in
docs/security-posture.mdargues that aleaked token cannot be exchanged for anything on its own, because the continuation
step "still requires the OTP code, the magic-link token, or a WebAuthn assertion".
That reasoning depends on the continuation credential being single use, and the
entry never said what makes the assertion one. It now points at the challenge
store: the challenge lives in
webauthn_challengeswith a server-enforced TTL anda per-flow purpose, and
consumeChallengespends it on read, before verification,so no outcome leaves a challenge behind for an assertion to be replayed against.
Documentation only, stating what the code already does. No changeset: nothing
user-facing changes.
Why now
This was the last outstanding remediation item on the WebAuthn challenge replay
advisory, which I verified against
mainand closed today. The entry as writtenunderstated the protection it claims, which is worth correcting whether or not
that advisory is ever published.