diff --git a/class-wporg-webauthn-provider.php b/class-wporg-webauthn-provider.php index d279321b..0cea22d2 100644 --- a/class-wporg-webauthn-provider.php +++ b/class-wporg-webauthn-provider.php @@ -75,6 +75,9 @@ public function _add_filters() { // Disable the admin UI if it needs revalidation. add_action( 'show_user_security_settings', [ $this, '_show_user_security_settings' ], -1 ); + // Disable EdDSA support for keys, to enable Android NFC to work with modern keys. + add_action( 'wp_ajax_webauthn_preregister', [ $this, '_remove_eddsa_alg' ], 1 ); + // Extend the session revalidation after registering a new key. add_action( 'wp_ajax_webauthn_register', [ $this, '_extend_revalidation' ], 1 ); } @@ -125,6 +128,33 @@ public function _extend_revalidation() { } ); } + /** + * Resolve Android NFC Security Key issues when a newer key is registered through a desktop client. + * + * This disables EdDSA (aka. ES25519) support, which Android NFC appears to lack. + * + * @see https://github.com/sjinks/wp-two-factor-provider-webauthn/issues/221#issuecomment-1539543124 + */ + public function _remove_eddsa_alg() { + ob_start( function( $output ) { + $json = json_decode( $output ); + + if ( $json && ! empty( $json->data->options->pubKeyCredParams ) ) { + $json->data->options->pubKeyCredParams = array_values( + wp_list_filter( + $json->data->options->pubKeyCredParams, + [ 'alg' => -8 ], + 'NOT' + ) + ); + + $output = wp_json_encode( $json ); + } + + return $output; + } ); + } + public function _clear_cache() { wp_cache_delete( 'webauthn:' . get_current_user_id(), 'users' ); } diff --git a/wporg-two-factor.php b/wporg-two-factor.php index 1e7db3ac..995663d9 100644 --- a/wporg-two-factor.php +++ b/wporg-two-factor.php @@ -185,7 +185,7 @@ function user_requires_2fa( $user ) : bool { return false; } } - // @codeCoverageIgnoreEnd + // @codeCoverageIgnoreEnd $required = false;