From e8d41bc2fe9418613cdc118c8674fc5fe7856685 Mon Sep 17 00:00:00 2001 From: santiagorodriguez96 <46354312+santiagorodriguez96@users.noreply.github.com> Date: Mon, 24 Aug 2020 11:46:27 -0300 Subject: Add WebAuthn as an alternative 2FA method (#14466) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula --- config/initializers/webauthn.rb | 24 ++++++++++++++++++++ config/locales/devise.en.yml | 17 +++++++++++++++ config/locales/en.yml | 46 ++++++++++++++++++++++++++++++++------- config/locales/simple_form.en.yml | 4 ++++ config/navigation.rb | 2 +- config/routes.rb | 18 ++++++++++++++- 6 files changed, 101 insertions(+), 10 deletions(-) create mode 100644 config/initializers/webauthn.rb (limited to 'config') diff --git a/config/initializers/webauthn.rb b/config/initializers/webauthn.rb new file mode 100644 index 000000000..a0a5b8153 --- /dev/null +++ b/config/initializers/webauthn.rb @@ -0,0 +1,24 @@ +WebAuthn.configure do |config| + # This value needs to match `window.location.origin` evaluated by + # the User Agent during registration and authentication ceremonies. + config.origin = "#{Rails.configuration.x.use_https ? 'https' : 'http' }://#{Rails.configuration.x.web_domain}" + + # Relying Party name for display purposes + config.rp_name = "Mastodon" + + # Optionally configure a client timeout hint, in milliseconds. + # This hint specifies how long the browser should wait for an + # attestation or an assertion response. + # This hint may be overridden by the browser. + # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout + config.credential_options_timeout = 120_000 + + # You can optionally specify a different Relying Party ID + # (https://www.w3.org/TR/webauthn/#relying-party-identifier) + # if it differs from the default one. + # + # In this case the default would be "auth.example.com", but you can set it to + # the suffix "example.com" + # + # config.rp_id = "example.com" +end diff --git a/config/locales/devise.en.yml b/config/locales/devise.en.yml index 726d2426a..a3f2c5796 100644 --- a/config/locales/devise.en.yml +++ b/config/locales/devise.en.yml @@ -60,6 +60,23 @@ en: title: 2FA recovery codes changed unlock_instructions: subject: 'Mastodon: Unlock instructions' + webauthn_credential: + added: + explanation: The following security key has been added to your account + subject: 'Mastodon: New security key' + title: A new security key has been added + deleted: + explanation: The following security key has been deleted from your account + subject: 'Mastodon: Security key deleted' + title: One of you security keys has been deleted + webauthn_disabled: + explanation: Authentication with security keys has been disabled for your account. Login is now possible using only the token generated by the paired TOTP app. + subject: 'Mastodon: Authentication with security keys disabled' + title: Security keys disabled + webauthn_enabled: + explanation: Security key authentication has been enabled for your account. Your security key can now be used for login. + subject: 'Mastodon: Security key authentication enabled' + title: Security keys enabled omniauth_callbacks: failure: Could not authenticate you from %{kind} because "%{reason}". success: Successfully authenticated from %{kind} account. diff --git a/config/locales/en.yml b/config/locales/en.yml index 40adfc21e..ab96074fd 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -681,8 +681,11 @@ en: prefix_sign_up: Sign up on Mastodon today! suffix: With an account, you will be able to follow people, post updates and exchange messages with users from any Mastodon server and more! didnt_get_confirmation: Didn't receive confirmation instructions? + dont_have_your_security_key: Don't have your security key? forgot_password: Forgot your password? invalid_reset_password_token: Password reset token is invalid or expired. Please request a new one. + link_to_otp: Enter a two-factor code from your phone or a recovery code + link_to_webauth: Use your security key device login: Log in logout: Logout migrate_account: Move to a different account @@ -708,6 +711,7 @@ en: pending: Your application is pending review by our staff. This may take some time. You will receive an e-mail if your application is approved. redirecting_to: Your account is inactive because it is currently redirecting to %{acct}. trouble_logging_in: Trouble logging in? + use_security_key: Use security key authorize_follow: already_following: You are already following this account already_requested: You have already sent a follow request to that account @@ -732,6 +736,7 @@ en: date: formats: default: "%b %d, %Y" + with_month_name: "%B %d, %Y" datetime: distance_in_words: about_x_hours: "%{count}h" @@ -993,6 +998,14 @@ en: thousand: K trillion: T unit: '' + otp_authentication: + code_hint: Enter the code generated by your authenticator app to confirm + description_html: If you enable two-factor authentication using an authenticator app, logging in will require you to be in possession of your phone, which will generate tokens for you to enter. + enable: Enable + instructions_html: "Scan this QR code into Google Authenticator or a similiar TOTP app on your phone. From now on, that app will generate tokens that you will have to enter when logging in." + manual_instructions: 'If you can''t scan the QR code and need to enter it manually, here is the plain-text secret:' + setup: Set up + wrong_code: The entered code was invalid! Are server time and device time correct? pagination: newer: Newer next: Next @@ -1117,6 +1130,7 @@ en: profile: Profile relationships: Follows and followers two_factor_authentication: Two-factor Auth + webauthn_authentication: Security keys spam_check: spam_detected: This is an automated report. Spam has been detected. statuses: @@ -1263,21 +1277,20 @@ en: default: "%b %d, %Y, %H:%M" month: "%b %Y" two_factor_authentication: - code_hint: Enter the code generated by your authenticator app to confirm - description_html: If you enable two-factor authentication, logging in will require you to be in possession of your phone, which will generate tokens for you to enter. - disable: Disable - enable: Enable + add: Add + disable: Disable 2FA + disabled_success: Two-factor authentication successfully disabled + edit: Edit enabled: Two-factor authentication is enabled enabled_success: Two-factor authentication successfully enabled generate_recovery_codes: Generate recovery codes - instructions_html: "Scan this QR code into Google Authenticator or a similiar TOTP app on your phone. From now on, that app will generate tokens that you will have to enter when logging in." lost_recovery_codes: Recovery codes allow you to regain access to your account if you lose your phone. If you've lost your recovery codes, you can regenerate them here. Your old recovery codes will be invalidated. - manual_instructions: 'If you can''t scan the QR code and need to enter it manually, here is the plain-text secret:' + methods: Two-factor methods + otp: Authenticator app recovery_codes: Backup recovery codes recovery_codes_regenerated: Recovery codes successfully regenerated recovery_instructions_html: If you ever lose access to your phone, you can use one of the recovery codes below to regain access to your account. Keep the recovery codes safe. For example, you may print them and store them with other important documents. - setup: Set up - wrong_code: The entered code was invalid! Are server time and device time correct? + webauthn: Security keys user_mailer: backup_ready: explanation: You requested a full backup of your Mastodon account. It's now ready for download! @@ -1339,3 +1352,20 @@ en: verification: explanation_html: 'You can verify yourself as the owner of the links in your profile metadata. For that, the linked website must contain a link back to your Mastodon profile. The link back must have a rel="me" attribute. The text content of the link does not matter. Here is an example:' verification: Verification + webauthn_credentials: + add: Add new security key + create: + error: There was a problem adding your security key. Please try again. + success: Your security key was successfully added. + delete: Delete + delete_confirmation: Are you sure you want to delete this security key? + description_html: If you enable security key authentication, logging in will require you to use one of your security keys. + destroy: + error: There was a problem deleting you security key. Please try again. + success: Your security key was successfully deleted. + invalid_credential: Invalid security key + nickname_hint: Enter the nickname of your new security key + not_enabled: You haven't enabled WebAuthn yet + not_supported: This browser doesn't support security keys + otp_required: To use security keys please enable two-factor authentication first. + registered_on: Registered on %{date} diff --git a/config/locales/simple_form.en.yml b/config/locales/simple_form.en.yml index 0a8a6fd62..4ab0d1871 100644 --- a/config/locales/simple_form.en.yml +++ b/config/locales/simple_form.en.yml @@ -67,6 +67,7 @@ en: text: This will help us review your application sessions: otp: 'Enter the two-factor code generated by your phone app or use one of your recovery codes:' + webauthn: If it's an USB key be sure to insert it and, if necessary, tap it. tag: name: You can only change the casing of the letters, for example, to make it more readable user: @@ -188,4 +189,7 @@ en: required: mark: "*" text: required + title: + sessions: + webauthn: Use one of your security keys to sign in 'yes': 'Yes' diff --git a/config/navigation.rb b/config/navigation.rb index 8fd296d5a..ece41d4bf 100644 --- a/config/navigation.rb +++ b/config/navigation.rb @@ -21,7 +21,7 @@ SimpleNavigation::Configuration.run do |navigation| n.item :security, safe_join([fa_icon('lock fw'), t('settings.account')]), edit_user_registration_url do |s| s.item :password, safe_join([fa_icon('lock fw'), t('settings.account_settings')]), edit_user_registration_url, highlights_on: %r{/auth/edit|/settings/delete|/settings/migration|/settings/aliases} - s.item :two_factor_authentication, safe_join([fa_icon('mobile fw'), t('settings.two_factor_authentication')]), settings_two_factor_authentication_url, highlights_on: %r{/settings/two_factor_authentication} + s.item :two_factor_authentication, safe_join([fa_icon('mobile fw'), t('settings.two_factor_authentication')]), settings_two_factor_authentication_methods_url, highlights_on: %r{/settings/two_factor_authentication|/settings/security_keys} s.item :authorized_apps, safe_join([fa_icon('list fw'), t('settings.authorized_apps')]), oauth_authorized_applications_url end diff --git a/config/routes.rb b/config/routes.rb index b55221925..2c39b36ed 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -45,6 +45,7 @@ Rails.application.routes.draw do namespace :auth do resource :setup, only: [:show, :update], controller: :setup resource :challenge, only: [:create], controller: :challenges + get 'sessions/security_key_options', to: 'sessions#webauthn_options' end end @@ -124,7 +125,22 @@ Rails.application.routes.draw do resources :domain_blocks, only: :index, controller: :blocked_domains end - resource :two_factor_authentication, only: [:show, :create, :destroy] + resources :two_factor_authentication_methods, only: [:index] do + collection do + post :disable + end + end + + resource :otp_authentication, only: [:show, :create], controller: 'two_factor_authentication/otp_authentication' + + resources :webauthn_credentials, only: [:index, :new, :create, :destroy], + path: 'security_keys', + controller: 'two_factor_authentication/webauthn_credentials' do + + collection do + get :options + end + end namespace :two_factor_authentication do resources :recovery_codes, only: [:create] -- cgit From 8dc66ca4734b428c543d91fb0f405d8543356603 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2020 22:50:47 +0900 Subject: Bump imports-loader from 0.8.0 to 1.1.0 (#14323) * Bump imports-loader from 0.8.0 to 1.1.0 Bumps [imports-loader](https://github.com/webpack-contrib/imports-loader) from 0.8.0 to 1.1.0. - [Release notes](https://github.com/webpack-contrib/imports-loader/releases) - [Changelog](https://github.com/webpack-contrib/imports-loader/blob/master/CHANGELOG.md) - [Commits](https://github.com/webpack-contrib/imports-loader/compare/v0.8.0...v1.1.0) Signed-off-by: dependabot[bot] * Migrate new syntax * Add semicolon Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yamagishi Kazutoshi --- config/webpack/production.js | 2 +- package.json | 2 +- yarn.lock | 19 +++++++++++++------ 3 files changed, 15 insertions(+), 8 deletions(-) (limited to 'config') diff --git a/config/webpack/production.js b/config/webpack/production.js index bceffaf5c..f2f216422 100644 --- a/config/webpack/production.js +++ b/config/webpack/production.js @@ -87,7 +87,7 @@ module.exports = merge(sharedConfig, { '**/*.woff', ], ServiceWorker: { - entry: `imports-loader?ATTACHMENT_HOST=>${encodeURIComponent(JSON.stringify(attachmentHost))}!${encodeURI(path.join(__dirname, '../../app/javascript/mastodon/service_worker/entry.js'))}`, + entry: `imports-loader?additionalCode=${encodeURIComponent(`var ATTACHMENT_HOST=${JSON.stringify(attachmentHost)};`)}!${encodeURI(path.join(__dirname, '../../app/javascript/mastodon/service_worker/entry.js'))}`, cacheName: 'mastodon', output: '../assets/sw.js', publicPath: '/sw.js', diff --git a/package.json b/package.json index abe4d778c..457e414d2 100644 --- a/package.json +++ b/package.json @@ -101,7 +101,7 @@ "history": "^4.10.1", "http-link-header": "^1.0.2", "immutable": "^3.8.2", - "imports-loader": "^0.8.0", + "imports-loader": "^1.1.0", "intersection-observer": "^0.11.0", "intl": "^1.2.5", "intl-messageformat": "^2.2.0", diff --git a/yarn.lock b/yarn.lock index 9a5b2d5a0..4088b37a7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5527,13 +5527,15 @@ import-local@^3.0.2: pkg-dir "^4.2.0" resolve-cwd "^3.0.0" -imports-loader@^0.8.0: - version "0.8.0" - resolved "https://registry.yarnpkg.com/imports-loader/-/imports-loader-0.8.0.tgz#030ea51b8ca05977c40a3abfd9b4088fe0be9a69" - integrity sha512-kXWL7Scp8KQ4552ZcdVTeaQCZSLW+e6nJfp3cwUMB673T7Hr98Xjx5JK+ql7ADlJUvj1JS5O01RLbKoutN5QDQ== +imports-loader@^1.1.0: + version "1.1.0" + resolved "https://registry.yarnpkg.com/imports-loader/-/imports-loader-1.1.0.tgz#1c3a388d0c5cd7f9eb08f3646d4aae3b70e57933" + integrity sha512-HcPM6rULdQ6EBLVq+5O+CF9xb7qiUjsRm6V28bTG/c3IU5sQkVZzUDwYY0r4jHvSAmVFdO9WA/vLAURR5WQSeQ== dependencies: - loader-utils "^1.0.2" + loader-utils "^2.0.0" + schema-utils "^2.7.0" source-map "^0.6.1" + strip-comments "^2.0.1" imurmurhash@^0.1.4: version "0.1.4" @@ -6778,7 +6780,7 @@ loader-utils@0.2.x: json5 "^0.5.0" object-assign "^4.0.1" -loader-utils@^1.0.2, loader-utils@^1.1.0, loader-utils@^1.2.3, loader-utils@^1.4.0: +loader-utils@^1.1.0, loader-utils@^1.2.3, loader-utils@^1.4.0: version "1.4.0" resolved "https://registry.yarnpkg.com/loader-utils/-/loader-utils-1.4.0.tgz#c579b5e34cb34b1a74edc6c1fb36bfa371d5a613" integrity sha512-qH0WSMBtn/oHuwjy/NucEgbx5dbxxnxup9s4PVXJUDHZBQY+s0NWA9rJf53RBnQZxfch7euUui7hpoAPvALZdA== @@ -10210,6 +10212,11 @@ strip-bom@^4.0.0: resolved "https://registry.yarnpkg.com/strip-bom/-/strip-bom-4.0.0.tgz#9c3505c1db45bcedca3d9cf7a16f5c5aa3901878" integrity sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w== +strip-comments@^2.0.1: + version "2.0.1" + resolved "https://registry.yarnpkg.com/strip-comments/-/strip-comments-2.0.1.tgz#4ad11c3fbcac177a67a40ac224ca339ca1c1ba9b" + integrity sha512-ZprKx+bBLXv067WTCALv8SSz5l2+XhpYCsVtSqlMnkAXMWDq+/ekVbl1ghqP9rUHTzv6sm/DwCOiYutU/yp1fw== + strip-eof@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/strip-eof/-/strip-eof-1.0.0.tgz#bb43ff5598a6eb05d89b59fcd129c983313606bf" -- cgit