2FA (Webauthn) #5795

woodruffw · 2019-05-06T19:40:54Z

Begins work on Webauthn as a supported 2FA method.

TODO:

Fill out the utils.webauthn helper methods
Link the helpers up to the Webauthn model via IUserService
Frontend integration (navigator.credentials)
Provisioning, removing, authentication with security keys
Allow multiple security keys
Unit tests

cc @brainwane @nlhkabu @di @ewdurbin @dstufft

warehouse/accounts/models.py

warehouse/accounts/views.py

tests/unit/packaging/test_models.py

woodruffw · 2019-06-03T18:40:16Z

Hey @brainwane @di @dstufft @ewdurbin -- this should be good for a review!

We're still waiting on duo-labs/py_webauthn#41 for multiple WebAuthn credential support; we can either push forwards with this PR and begin a new one for multiple credentials, or wait on that (and begin another task) while they cut a release. Thoughts?

di · 2019-06-03T19:33:54Z

I think I'd prefer to merge this for support w/ multiple credentials if the Duo team's timeline is compatible with ours.

@mschwager, is there anything you can do to help us resolve duo-labs/py_webauthn#41?

ewdurbin · 2019-06-03T19:44:01Z

This seems functionally excellent.

Looks like we still need to sort out:

~~Two skipped tests~~ Edit: looks like I was viewing outdated comments
Design concern on the TOTP vs WebAuthn forms/routes
UX/UI @nlhkabu will you have time to review?
Multiple registered devices, blocked on webauthn release

Adds requisite view behavior, client-side handling, templates, interfaces, and services. Still incomplete.

Initial login work.

Adds the client-side JS needed for login, some of the form validation, some of the views, some of the services.

Set cookie properly on WebAuthn login.

warehouse/manage/forms.py

nlhkabu · 2019-06-13T06:02:34Z

@woodruffw I've now updated the UI:

No 2fa

2fa by TOTP only

Single security key

Multiple security keys

Add key page

Remove key modal

nlhkabu · 2019-06-13T06:04:45Z

@woodruffw it seems I've broken the remove modal - when trying to remove a key, I am getting a 404 error. I can't work out how to fix it - could you please look into this?

woodruffw · 2019-06-13T13:29:03Z

Sure, I'll take a look in a moment.

py_webauthn does not do this for us.

ewdurbin

Once we get the signing counter issues sorted, this looks 💯 to me.

This should be done by the authenticator, but isn't.

For real this time.

Emphasizes that we do WebAuthn validation elsewhere. See: pypi#5795 (comment)

merwok · 2019-07-23T18:44:08Z

warehouse/templates/pages/help.html

@@ -83,6 +84,7 @@ <h2><a href="#my-account">My Account</a></h2>
          <li><a href="#compromised-password">{{ compromised_password() }}</a></li>
          <li><a href="#2fa">{{ twoFA() }}</a></li>
          <li><a href="#totp">{{ totp() }}</a></li>
+          <li><a href="#utfkey">{{ utfkey() }}</a></li>


I did a double-take at utf 🙂
IIUC this is about U2F keys, not Unicode’s UTF, right?

It is about U2F keys and not Unicode's UTF; the T stands for "two". I'm ok with this since it's just an anchor tag, but if you want to change it I figure a PR would be pretty easy!

woodruffw mentioned this pull request May 6, 2019

2FA (TOTP) support #5567

Merged

dstufft reviewed May 6, 2019

View reviewed changes

warehouse/accounts/models.py Outdated Show resolved Hide resolved

woodruffw commented May 14, 2019

View reviewed changes

warehouse/accounts/views.py Show resolved Hide resolved

brainwane mentioned this pull request May 16, 2019

Add support for two-factor authentication #996

Closed

brainwane added this to the OTF Security work milestone May 16, 2019

woodruffw commented May 16, 2019

View reviewed changes

tests/unit/packaging/test_models.py Outdated Show resolved Hide resolved

woodruffw commented May 16, 2019

View reviewed changes

tests/unit/packaging/test_models.py Outdated Show resolved Hide resolved

nlhkabu mentioned this pull request May 19, 2019

2FA User Interfaces (authentication workflow) #5587

Closed

woodruffw mentioned this pull request May 24, 2019

Allow multiple credentials during assertion duo-labs/py_webauthn#39

Merged

woodruffw mentioned this pull request Jun 3, 2019

Cutting a new release duo-labs/py_webauthn#41

Closed

woodruffw changed the title ~~[WIP] 2FA (Webauthn)~~ 2FA (Webauthn) Jun 3, 2019

woodruffw added 16 commits June 4, 2019 10:26

warehouse: Initial Webauthn model, relationship

8e47b68

models: Remove unused properties

cfbc1a3

requirements: webauthn

623f3da

warehouse: WIP webauthn utilities

df1519d

warehouse: Add more view/route/template structure

86100cc

warehouse: WebAuthn provisioning groundwork

fc44a1b

Adds requisite view behavior, client-side handling, templates, interfaces, and services. Still incomplete.

warehouse: Functional WebAuthn provisioning and deprovisioning

172dfc7

warehouse: Provisioning splashes

215aab2

warehouse: WebAuthn mixin, refactor JS

c2b5a57

Initial login work.

warehouse: Implicit lambda

15a5bf9

warehouse: More login work

ca4a1a5

Adds the client-side JS needed for login, some of the form validation, some of the views, some of the services.

warehouse: Functional WebAuthn authentication

14a65c8

migrations: Rebase migration

9a0b2a9

warehouse: Fix TOTP login, add redirection to WebAutnn

a004189

warehouse: Simplify 2FA data retrieval during login

2691825

Set cookie properly on WebAuthn login.

warehouse: Update service interface, autoformatting

9d6b68a

woodruffw added 2 commits June 10, 2019 14:11

tests: Add another form test

64102e8

tests: Complete form coverage

adea600

woodruffw commented Jun 10, 2019

View reviewed changes

warehouse/manage/forms.py Show resolved Hide resolved

woodruffw commented Jun 10, 2019

View reviewed changes

warehouse/manage/forms.py Show resolved Hide resolved

woodruffw and others added 4 commits June 10, 2019 18:14

warehouse: Add label length limits

ba77123

Merge branch 'master' into tob-webauthn

bc043bb

Merge branch 'master' into tob-webauthn

26eede6

Update webauthn provisioning UI

4ab2464

woodruffw added 4 commits June 13, 2019 09:51

warehouse: Update WebAuthn deletion form param

967aa44

warehouse: Fix HTML formatting

8f9b809

warehouse: Update WebAuthn signage count

2371691

py_webauthn does not do this for us.

tests: Update WebAuthn provisioning test

cf96def

ewdurbin approved these changes Jun 13, 2019

View reviewed changes

woodruffw and others added 8 commits June 13, 2019 12:32

warehouse: Don't bump signage on enrollment, only auth

0048c46

tests: Update tests for sign count changes

9bcb95a

warehouse, tests: Remove artifical sign_count bumping

fb8d507

This should be done by the authenticator, but isn't.

warehouse: Fix sign count updating

9d352aa

For real this time.

tests: Fix, update tests

9cd2ee8

Merge branch 'master' into tob-webauthn

39087db

warehouse, tests: Rename two_factor to two_factor_and_totp_validate

5357401

Emphasizes that we do WebAuthn validation elsewhere. See: pypi#5795 (comment)

tests: Auto-format

06637aa

ewdurbin merged commit 59ab1f2 into pypi:master Jun 17, 2019

woodruffw deleted the tob-webauthn branch June 17, 2019 15:13

brainwane mentioned this pull request Jun 18, 2019

Test for new routes/query parameters that aren't in caching whitelist #6041

Open

merwok reviewed Jul 23, 2019

View reviewed changes

justinmayer mentioned this pull request Aug 16, 2019

Attestation root certificates as PEM solokeys/solo1#275

Open

ewdurbin mentioned this pull request May 31, 2023

publish entire blog content to feed #13813

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

2FA (Webauthn) #5795

2FA (Webauthn) #5795

Uh oh!

woodruffw commented May 6, 2019 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Jun 3, 2019

Uh oh!

di commented Jun 3, 2019

Uh oh!

ewdurbin commented Jun 3, 2019 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

nlhkabu commented Jun 13, 2019 •

edited

Loading

Uh oh!

nlhkabu commented Jun 13, 2019

Uh oh!

woodruffw commented Jun 13, 2019

Uh oh!

ewdurbin left a comment

Uh oh!

merwok Jul 23, 2019

Uh oh!

brainwane Jul 23, 2019

Uh oh!

Uh oh!

2FA (Webauthn) #5795

2FA (Webauthn) #5795

Uh oh!

Conversation

woodruffw commented May 6, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Jun 3, 2019

Uh oh!

di commented Jun 3, 2019

Uh oh!

ewdurbin commented Jun 3, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nlhkabu commented Jun 13, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

No 2fa

2fa by TOTP only

Single security key

Multiple security keys

Add key page

Remove key modal

Uh oh!

nlhkabu commented Jun 13, 2019

Uh oh!

woodruffw commented Jun 13, 2019

Uh oh!

ewdurbin left a comment

Choose a reason for hiding this comment

Uh oh!

merwok Jul 23, 2019

Choose a reason for hiding this comment

Uh oh!

brainwane Jul 23, 2019

Choose a reason for hiding this comment

Uh oh!

Uh oh!

woodruffw commented May 6, 2019 •

edited

Loading

ewdurbin commented Jun 3, 2019 •

edited

Loading

nlhkabu commented Jun 13, 2019 •

edited

Loading