diff options
Diffstat (limited to 'config')
| -rw-r--r-- | config/initializers/webauthn.rb | 24 | ||||
| -rw-r--r-- | config/locales/devise.en.yml | 17 | ||||
| -rw-r--r-- | config/locales/en.yml | 46 | ||||
| -rw-r--r-- | config/locales/simple_form.en.yml | 4 | ||||
| -rw-r--r-- | config/navigation.rb | 2 | ||||
| -rw-r--r-- | config/routes.rb | 18 |
6 files changed, 101 insertions, 10 deletions
diff --git a/config/initializers/webauthn.rb b/config/initializers/webauthn.rb new file mode 100644 index 000000000..a0a5b8153 --- /dev/null +++ b/config/initializers/webauthn.rb @@ -0,0 +1,24 @@ +WebAuthn.configure do |config| + # This value needs to match `window.location.origin` evaluated by + # the User Agent during registration and authentication ceremonies. + config.origin = "#{Rails.configuration.x.use_https ? 'https' : 'http' }://#{Rails.configuration.x.web_domain}" + + # Relying Party name for display purposes + config.rp_name = "Mastodon" + + # Optionally configure a client timeout hint, in milliseconds. + # This hint specifies how long the browser should wait for an + # attestation or an assertion response. + # This hint may be overridden by the browser. + # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout + config.credential_options_timeout = 120_000 + + # You can optionally specify a different Relying Party ID + # (https://www.w3.org/TR/webauthn/#relying-party-identifier) + # if it differs from the default one. + # + # In this case the default would be "auth.example.com", but you can set it to + # the suffix "example.com" + # + # config.rp_id = "example.com" +end diff --git a/config/locales/devise.en.yml b/config/locales/devise.en.yml index 726d2426a..a3f2c5796 100644 --- a/config/locales/devise.en.yml +++ b/config/locales/devise.en.yml @@ -60,6 +60,23 @@ en: title: 2FA recovery codes changed unlock_instructions: subject: 'Mastodon: Unlock instructions' + webauthn_credential: + added: + explanation: The following security key has been added to your account + subject: 'Mastodon: New security key' + title: A new security key has been added + deleted: + explanation: The following security key has been deleted from your account + subject: 'Mastodon: Security key deleted' + title: One of you security keys has been deleted + webauthn_disabled: + explanation: Authentication with security keys has been disabled for your account. Login is now possible using only the token generated by the paired TOTP app. + subject: 'Mastodon: Authentication with security keys disabled' + title: Security keys disabled + webauthn_enabled: + explanation: Security key authentication has been enabled for your account. Your security key can now be used for login. + subject: 'Mastodon: Security key authentication enabled' + title: Security keys enabled omniauth_callbacks: failure: Could not authenticate you from %{kind} because "%{reason}". success: Successfully authenticated from %{kind} account. diff --git a/config/locales/en.yml b/config/locales/en.yml index 40adfc21e..ab96074fd 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -681,8 +681,11 @@ en: prefix_sign_up: Sign up on Mastodon today! suffix: With an account, you will be able to follow people, post updates and exchange messages with users from any Mastodon server and more! didnt_get_confirmation: Didn't receive confirmation instructions? + dont_have_your_security_key: Don't have your security key? forgot_password: Forgot your password? invalid_reset_password_token: Password reset token is invalid or expired. Please request a new one. + link_to_otp: Enter a two-factor code from your phone or a recovery code + link_to_webauth: Use your security key device login: Log in logout: Logout migrate_account: Move to a different account @@ -708,6 +711,7 @@ en: pending: Your application is pending review by our staff. This may take some time. You will receive an e-mail if your application is approved. redirecting_to: Your account is inactive because it is currently redirecting to %{acct}. trouble_logging_in: Trouble logging in? + use_security_key: Use security key authorize_follow: already_following: You are already following this account already_requested: You have already sent a follow request to that account @@ -732,6 +736,7 @@ en: date: formats: default: "%b %d, %Y" + with_month_name: "%B %d, %Y" datetime: distance_in_words: about_x_hours: "%{count}h" @@ -993,6 +998,14 @@ en: thousand: K trillion: T unit: '' + otp_authentication: + code_hint: Enter the code generated by your authenticator app to confirm + description_html: If you enable <strong>two-factor authentication</strong> using an authenticator app, logging in will require you to be in possession of your phone, which will generate tokens for you to enter. + enable: Enable + instructions_html: "<strong>Scan this QR code into Google Authenticator or a similiar TOTP app on your phone</strong>. From now on, that app will generate tokens that you will have to enter when logging in." + manual_instructions: 'If you can''t scan the QR code and need to enter it manually, here is the plain-text secret:' + setup: Set up + wrong_code: The entered code was invalid! Are server time and device time correct? pagination: newer: Newer next: Next @@ -1117,6 +1130,7 @@ en: profile: Profile relationships: Follows and followers two_factor_authentication: Two-factor Auth + webauthn_authentication: Security keys spam_check: spam_detected: This is an automated report. Spam has been detected. statuses: @@ -1263,21 +1277,20 @@ en: default: "%b %d, %Y, %H:%M" month: "%b %Y" two_factor_authentication: - code_hint: Enter the code generated by your authenticator app to confirm - description_html: If you enable <strong>two-factor authentication</strong>, logging in will require you to be in possession of your phone, which will generate tokens for you to enter. - disable: Disable - enable: Enable + add: Add + disable: Disable 2FA + disabled_success: Two-factor authentication successfully disabled + edit: Edit enabled: Two-factor authentication is enabled enabled_success: Two-factor authentication successfully enabled generate_recovery_codes: Generate recovery codes - instructions_html: "<strong>Scan this QR code into Google Authenticator or a similiar TOTP app on your phone</strong>. From now on, that app will generate tokens that you will have to enter when logging in." lost_recovery_codes: Recovery codes allow you to regain access to your account if you lose your phone. If you've lost your recovery codes, you can regenerate them here. Your old recovery codes will be invalidated. - manual_instructions: 'If you can''t scan the QR code and need to enter it manually, here is the plain-text secret:' + methods: Two-factor methods + otp: Authenticator app recovery_codes: Backup recovery codes recovery_codes_regenerated: Recovery codes successfully regenerated recovery_instructions_html: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. <strong>Keep the recovery codes safe</strong>. For example, you may print them and store them with other important documents. - setup: Set up - wrong_code: The entered code was invalid! Are server time and device time correct? + webauthn: Security keys user_mailer: backup_ready: explanation: You requested a full backup of your Mastodon account. It's now ready for download! @@ -1339,3 +1352,20 @@ en: verification: explanation_html: 'You can <strong>verify yourself as the owner of the links in your profile metadata</strong>. For that, the linked website must contain a link back to your Mastodon profile. The link back <strong>must</strong> have a <code>rel="me"</code> attribute. The text content of the link does not matter. Here is an example:' verification: Verification + webauthn_credentials: + add: Add new security key + create: + error: There was a problem adding your security key. Please try again. + success: Your security key was successfully added. + delete: Delete + delete_confirmation: Are you sure you want to delete this security key? + description_html: If you enable <strong>security key authentication</strong>, logging in will require you to use one of your security keys. + destroy: + error: There was a problem deleting you security key. Please try again. + success: Your security key was successfully deleted. + invalid_credential: Invalid security key + nickname_hint: Enter the nickname of your new security key + not_enabled: You haven't enabled WebAuthn yet + not_supported: This browser doesn't support security keys + otp_required: To use security keys please enable two-factor authentication first. + registered_on: Registered on %{date} diff --git a/config/locales/simple_form.en.yml b/config/locales/simple_form.en.yml index 0a8a6fd62..4ab0d1871 100644 --- a/config/locales/simple_form.en.yml +++ b/config/locales/simple_form.en.yml @@ -67,6 +67,7 @@ en: text: This will help us review your application sessions: otp: 'Enter the two-factor code generated by your phone app or use one of your recovery codes:' + webauthn: If it's an USB key be sure to insert it and, if necessary, tap it. tag: name: You can only change the casing of the letters, for example, to make it more readable user: @@ -188,4 +189,7 @@ en: required: mark: "*" text: required + title: + sessions: + webauthn: Use one of your security keys to sign in 'yes': 'Yes' diff --git a/config/navigation.rb b/config/navigation.rb index 8fd296d5a..ece41d4bf 100644 --- a/config/navigation.rb +++ b/config/navigation.rb @@ -21,7 +21,7 @@ SimpleNavigation::Configuration.run do |navigation| n.item :security, safe_join([fa_icon('lock fw'), t('settings.account')]), edit_user_registration_url do |s| s.item :password, safe_join([fa_icon('lock fw'), t('settings.account_settings')]), edit_user_registration_url, highlights_on: %r{/auth/edit|/settings/delete|/settings/migration|/settings/aliases} - s.item :two_factor_authentication, safe_join([fa_icon('mobile fw'), t('settings.two_factor_authentication')]), settings_two_factor_authentication_url, highlights_on: %r{/settings/two_factor_authentication} + s.item :two_factor_authentication, safe_join([fa_icon('mobile fw'), t('settings.two_factor_authentication')]), settings_two_factor_authentication_methods_url, highlights_on: %r{/settings/two_factor_authentication|/settings/security_keys} s.item :authorized_apps, safe_join([fa_icon('list fw'), t('settings.authorized_apps')]), oauth_authorized_applications_url end diff --git a/config/routes.rb b/config/routes.rb index b55221925..2c39b36ed 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -45,6 +45,7 @@ Rails.application.routes.draw do namespace :auth do resource :setup, only: [:show, :update], controller: :setup resource :challenge, only: [:create], controller: :challenges + get 'sessions/security_key_options', to: 'sessions#webauthn_options' end end @@ -124,7 +125,22 @@ Rails.application.routes.draw do resources :domain_blocks, only: :index, controller: :blocked_domains end - resource :two_factor_authentication, only: [:show, :create, :destroy] + resources :two_factor_authentication_methods, only: [:index] do + collection do + post :disable + end + end + + resource :otp_authentication, only: [:show, :create], controller: 'two_factor_authentication/otp_authentication' + + resources :webauthn_credentials, only: [:index, :new, :create, :destroy], + path: 'security_keys', + controller: 'two_factor_authentication/webauthn_credentials' do + + collection do + get :options + end + end namespace :two_factor_authentication do resources :recovery_codes, only: [:create] |