[POC] WebAuthn CLI #2 - Sockets

[jenshenny]

What problem are you solving?

Prototype PR to adds support for WebAuthn on the CLI. Changes to the client can be found here: Client PR: Shopify/rubygems#37

Resources:

CLI Flows: https://docs.google.com/document/d/1FlIfW-zmvLmflOvo7oOUuEleQBTodo-8lVJdiRcYySw/edit#heading=h.kjywlfxfaool

What approach did you choose and why?

This flow is similar to the first prototype #56. and functionality is built from this prototype.

The main addition is 06bae61 and 4e81c17 commits.

It accepts a redirect_uri, and after the webauthn verification is completed, the rubygems.org server will redirect to the to the redirect_uri where the code will be sent as a param. The value of the redirect_uri is a localhost port. The response from the rubygems client will be render on the UI if successful.

sequenceDiagram
browser->>+RubyGems.org server: POST /authn (webauthn_credentials/verify)
RubyGems.org server-->>-browser: Redirect to localhost:5678?code=xyz
browser->>+Rubygems client (localhost): OPTIONS localhost:5678?code=xyz (preflight request since it's cross origin)
Rubygems client (localhost)-->>-browser: 204 No Content (answers preflight request)
browser->>+Rubygems client (localhost): GET localhost:5678?code=xyz
Rubygems client (localhost)-->>-browser: 200 OK, response text: Webauthn success

Loading

I don't think we need to have preflight requests but not sure if there's a way to disable it currently. More info on preflight requests https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request

Demo

Screen.Recording.2022-12-14.at.11.16.45.AM.mov

Notes / Stuff I haven't explored

• I think we should also accept TOTP in the client prompt, haven't explored killing the listener if an OTP is inputted and vice versa, continuing the process once WebAuthn verification is done (done in the polling prototype).
• Displaying the verification link has a localhost param - might not be that pleasing to the eye (is fixable).

[jchestershopify]

Closing as we are moving to the proper implementation.