I want to implement webauthn using PHP (specifically Yii2 Framework) along with the SimpleWebAuthnBrowser library (https://simplewebauthn.dev/docs/packages/browser)
When registering the device, here is my response for the challenge
return [
'challenge' => $challengeBase64,
'rp' => [
'name' => Yii::$app->name,
'id' => 'x-y-z.ngrok-free.app',
],
'user' => [
'id' => $userId,
'name' => $displayName,
'displayName' => $displayName,
],
'pubKeyCredParams' => [
['type' => 'public-key', 'alg' => -7],
['type' => 'public-key', 'alg' => -257],
],
'authenticatorSelection' => [
'authenticatorAttachment' => 'cross-platform',
'requireResidentKey' => false,
'userVerification' => 'discouraged',
],
'timeout' => 60000,
'attestation' => 'direct',
'transports' => ['usb'],
];
On the registration view:
try {
// get challenge
let challengeResponse = await fetch('/user/challenge');
if (!challengeResponse.ok) {
throw new Error('Failed to get challenge from server');
}
let challengeData = await challengeResponse.json();
const attResp = await SimpleWebAuthnBrowser.startRegistration(challengeData);
// // get credential data
let credential_id = attResp.rawId;
let public_key = attResp.response.publicKey;
let sign_count = 0;
let transports = attResp.response.transports ? attResp.response.transports : [];
let attestation_type = attResp.type;
.....
The registration process is running well, and the credential saved to the database.
But when I need to validate / do the authentication, the library has an error
NotAllowedError: The operation either timed out or was not allowed. See: https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.
Here is my code on the view and return from the challenge.
try {
const response = await fetch('/user/another-challenge', { method: 'GET' });
const options = await response.json();
const assertion = await SimpleWebAuthnBrowser.startAuthentication(options); // gives an error above
And here is the response for the /user/another-challenge
return [
'challenge' => Base64Url::encode($challenge),
'rp' => [
'name' => Yii::$app->name,
'id' => 'x-y-z.ngrok-free.app',
],
'user' => [
'id' => Base64Url::encode($user->id),
'name' => $user->username,
'displayName' => $user->username,
],
'allowCredentials' => [
[
'type' => 'public-key',
'id' => Base64Url::encode($credential->credential_id),
'transports' => ['usb'],
]
],
'timeout' => 60000,
'userVerification' => 'discouraged',
];
I am wondering if this has something to do with the response from the registration challenge (from the registration phase).
Any clue or guidance will be appreciated. Thank you.
