Allow WebAuthn on localhost as well

[MorrisJobke]

• browsers typically whiteliste this as well - https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
• for developing purposes see https://developer.chrome.com/docs/devtools/webauthn/

[MorrisJobke]

Additionally I needed to comment the assertions in the 3rdparty module, but then I could use it to locally test login with the Chrome fake device:

diff --git a/web-auth/webauthn-lib/src/AuthenticatorAssertionResponseValidator.php b/web-auth/webauthn-lib/src/AuthenticatorAssertionResponseValidator.php
index 8400ba9c..49279cc7 100644
--- a/web-auth/webauthn-lib/src/AuthenticatorAssertionResponseValidator.php
+++ b/web-auth/webauthn-lib/src/AuthenticatorAssertionResponseValidator.php
@@ -152,7 +152,7 @@ class AuthenticatorAssertionResponseValidator
             Assertion::isArray($parsedRelyingPartyId, 'Invalid origin');
             if (!in_array($facetId, $securedRelyingPartyId, true)) {
                 $scheme = $parsedRelyingPartyId['scheme'] ?? '';
-                Assertion::eq('https', $scheme, 'Invalid scheme. HTTPS required.');
+                #Assertion::eq('https', $scheme, 'Invalid scheme. HTTPS required.');
             }
             $clientDataRpId = $parsedRelyingPartyId['host'] ?? '';
             Assertion::notEmpty($clientDataRpId, 'Invalid origin rpId.');
diff --git a/web-auth/webauthn-lib/src/AuthenticatorAttestationResponseValidator.php b/web-auth/webauthn-lib/src/AuthenticatorAttestationResponseValidator.php
index f3e5a15d..3927bf23 100644
--- a/web-auth/webauthn-lib/src/AuthenticatorAttestationResponseValidator.php
+++ b/web-auth/webauthn-lib/src/AuthenticatorAttestationResponseValidator.php
@@ -150,7 +150,7 @@ class AuthenticatorAttestationResponseValidator
 
             if (!in_array($facetId, $securedRelyingPartyId, true)) {
                 $scheme = $parsedRelyingPartyId['scheme'] ?? '';
-                Assertion::eq('https', $scheme, 'Invalid scheme. HTTPS required.');
+                #Assertion::eq('https', $scheme, 'Invalid scheme. HTTPS required.');
             }
 
             /* @see 7.1.6 */

[artonge]

I would prefer two props isHttps and isLocalhost to make the code more explicit

[MorrisJobke]

@artonge Do you mind to adjust it, because it then needs to pass this down all the layers?

[artonge]

I made the changes but did not test. But the changes are only for testing purposes (right ?), so 🙈, lets go !

[MorrisJobke]

I made the changes but did not test. But the changes are only for testing purposes (right ?), so 🙈, lets go !

Yes - only for testing. I will give it a try.

[MorrisJobke]

I made the changes but did not test. But the changes are only for testing purposes (right ?), so 🙈, lets go !

There were some properties missing in some intermediate views. And also some handovers of properties to nested views. I added them. And it works here now 👍

[artonge]

There were some properties missing in some intermediate views. And also some handovers of properties to nested views. I added them. And it works here now +1

Arf, sorry, went too fast...

[MorrisJobke]

CI is happy 🎉

[Pytal]

Looks good :)