Add support for FIDO U2F #3971

jonasfranz · 2018-05-15T20:55:09Z

Adds support for FIDO U2F as an addition to Two-Factor Authentication by Phone. ~~Currently it is only works with Chrome but I am trying to support Firefox and Android too.~~

Requirements

FIDO U2F certified key
Access via https

Video example

TODO

Improve error handling
Android (Chrome) support
~~iOS support (Hardware required)~~ (no software support by iOS currently)
Firefox support auth
Firefox support register
Expiration timer
Redirect / Check for https
Add tests (lots of tests)

iOS

~~I cannot test iOS at the moment because my security key does not support Bluetooth LE. If you want to provide me a BLE key, please contact me via Discord.~~ Thanks to @techknowlogick for sponsoring a Bluetooth LE key.

Signed-off-by: Jonas Franz <[email protected]>

Add missing translations Signed-off-by: Jonas Franz <[email protected]>

Signed-off-by: Jonas Franz <[email protected]>

codecov-io · 2018-05-15T21:13:22Z

Codecov Report

Merging #3971 into master will decrease coverage by 0.01%.
The diff coverage is 15.81%.

@@            Coverage Diff             @@
##           master    #3971      +/-   ##
==========================================
- Coverage   20.08%   20.06%   -0.02%     
==========================================
  Files         151      153       +2     
  Lines       29874    30122     +248     
==========================================
+ Hits         6000     6044      +44     
- Misses      22968    23168     +200     
- Partials      906      910       +4

Impacted Files	Coverage Δ
routers/user/auth.go	`0% <0%> (ø)`	⬆️
routers/user/setting/security.go	`0% <0%> (ø)`	⬆️
routers/user/setting/security_u2f.go	`0% <0%> (ø)`
models/models.go	`29.18% <100%> (+0.3%)`	⬆️
models/error.go	`20.22% <60%> (+0.56%)`	⬆️
models/u2f.go	`63.15% <63.15%> (ø)`
models/unit_tests.go	`72.56% <0%> (+3.53%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f933bcd...378b921. Read the comment docs.

jonasfranz · 2018-05-16T10:39:23Z

Test instance: https://try.h.jonasfranz.software/

… JS library Add U2F error handling Signed-off-by: Jonas Franz <[email protected]>

Signed-off-by: Jonas Franz <[email protected]>

# Conflicts: # routers/user/setting.go

Signed-off-by: Jonas Franz <[email protected]>

Renamed u2f table name Signed-off-by: Jonas Franz <[email protected]>

Signed-off-by: Jonas Franz <[email protected]>

techknowlogick · 2018-05-18T01:27:31Z

Firefox support above is checked off however I'm using FF 60.0 (64-bit), on MacOS 10.13.4, and I receive the following message:

The key I'm using is: https://www.yubico.com/product/yubikey-neo/

Is FF support just FF Mobile?

(I see a similar message when trying to add this key to GitHub, so it is likely my browser just has issues with U2F)

techknowlogick · 2018-05-18T01:30:09Z

custom/conf/app.ini.sample

@@ -570,6 +570,14 @@ MAX_RESPONSE_ITEMS = 50
 LANGS = en-US,zh-CN,zh-HK,zh-TW,de-DE,fr-FR,nl-NL,lv-LV,ru-RU,ja-JP,es-ES,pt-BR,pl-PL,bg-BG,it-IT,fi-FI,tr-TR,cs-CZ,sr-SP,sv-SE,ko-KR
 NAMES = English,简体中文,繁體中文（香港）,繁體中文（台灣）,Deutsch,français,Nederlands,latviešu,русский,日本語,español,português do Brasil,polski,български,italiano,suomi,Türkçe,čeština,српски,svenska,한국어

+[U2F]


Could you add a U2F section to the "Config Cheatsheet" page in the docs?

@techknowlogick done

jonasfranz · 2018-05-18T08:00:19Z

@techknowlogick Do you enabled u2f via about:config ?
Firefox Mobile for Android does not work at the moment because Google Authenticator only supports Chrome Mobile and not Firefox. U2F is handled by Google Authenticator at the moment. If you enable U2F via about:config on Firefox Mobile it does not work too.

Signed-off-by: Jonas Franz <[email protected]>

techknowlogick · 2018-05-18T13:22:55Z

@JonasFranzDEV Ah yes. Thank you for pointing me in that direction. Seems FF has it disabled by default. Enabled it and it works flawlessly.

LGTM

lafriks · 2018-05-18T14:08:10Z

custom/conf/app.ini.sample

+[U2F]
+; Two Factor authentication with security keys
+; https://developers.yubico.com/U2F/App_ID.html
+APP_ID = https://example.com


app.ini.sample should contain values that are same as default

genofire

Nice work - thank you
(Have some commants during reading)

genofire · 2018-05-18T16:08:10Z

public/js/index.js

+ u2fApi.ensureSupport()
+ .then(function () {
+ $.getJSON('/user/u2f/challenge').success(function(req) {
+ console.log(req);


Still needed?

genofire · 2018-05-18T16:11:35Z

public/js/index.js

+ if(req.registeredKeys === null) {
+ req.registeredKeys = []
+ }
+ console.log(req);


Still needed?

genofire · 2018-05-18T16:12:59Z

public/js/index.js

+ $.ajax({
+ url:'/user/u2f/sign',
+ type:"POST",
+ headers: {"X-Csrf-Token": csrf},


I would like X-CSRF-Token correct camelCase.

We use this at many other places at index.js so I would propose to use the current solution.

genofire · 2018-05-18T16:13:53Z

public/js/index.js

+ if (checkError(resp)) {
+ return;
+ }
+ console.log(resp);


Still needed?

genofire · 2018-05-18T16:14:39Z

public/js/index.js

+ $.ajax({
+ url:'/user/settings/security/u2f/register',
+ type:"POST",
+ headers: {"X-Csrf-Token": csrf},


Signed-off-by: Jonas Franz <[email protected]>

Add FIDO U2F to comparison Signed-off-by: Jonas Franz <[email protected]>

lafriks · 2018-05-19T14:11:07Z

I can not really test this but otherwise LGTM

webjoel · 2018-05-21T14:42:56Z

The default locale (english) for text (settings:u2f_desc): "Security keys are hardware devices containing cryptograhic keys. They could be used for two factor authentication. The security key must support the FIDO U2F standard." is incorrect in word "cryptograhic", correct is "cryptographic".

jonasfranz · 2018-05-21T19:22:01Z

Please create an issue for that Am 21. Mai 2018 16:43:04 MESZ schrieb Joel da Rosa <[email protected]>:

…

The default locale (english) for text (settings:u2f_desc): "Security keys are hardware devices containing cryptograhic keys. They could be used for two factor authentication. The security key must support the <a href="https://fidoalliance.org/">FIDO U2F</a> standard." is incorrect in word "cryptograhic", correct is "cryptographic". -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #3971 (comment)

-- Diese Nachricht wurde von meinem Android-Gerät mit K-9 Mail gesendet.

lafriks · 2018-05-21T20:07:07Z

Somebody already fixed it

TheAssassin · 2018-06-25T20:32:16Z

Can you tell when this feature will be released?

jonasfranz · 2018-06-26T11:21:36Z

We're trying to release 1.5 in the next days since we have only ~1-2 PRs which must be merged.

* SECURITY * Limit uploaded avatar image-size to 4096x3072 by default (go-gitea#4353) * Do not allow to reuse TOTP passcode (go-gitea#3878) * FEATURE * Add cli commands to regen hooks & keys (go-gitea#3979) * Add support for FIDO U2F (go-gitea#3971) * Added user language setting (go-gitea#3875) * LDAP Public SSH Keys synchronization (go-gitea#1844) * Add topic support (go-gitea#3711) * Multiple assignees (go-gitea#3705) * Add protected branch whitelists for merging (go-gitea#3689) * Global code search support (go-gitea#3664) * Add label descriptions (go-gitea#3662) * Add issue search via API (go-gitea#3612) * Add repository setting to enable/disable health checks (go-gitea#3607) * Emoji Autocomplete (go-gitea#3433) * Implements generator cli for secrets (go-gitea#3531) * ENHANCEMENT * Add more webhooks support and refactor webhook templates directory (go-gitea#3929) * Add new option to allow only OAuth2/OpenID user registration (go-gitea#3910) * Add option to use paged LDAP search when synchronizing users (go-gitea#3895) * Symlink icons (go-gitea#1416) * Improve release page UI (go-gitea#3693) * Add admin dashboard option to run health checks (go-gitea#3606) * Add branch link in branch list (go-gitea#3576) * Reduce sql query times in retrieveFeeds (go-gitea#3547) * Option to enable or disable swagger endpoints (go-gitea#3502) * Add missing licenses (go-gitea#3497) * Reduce repo indexer disk usage (go-gitea#3452) * Enable caching on assets and avatars (go-gitea#3376) * Add repository search ordered by stars/forks. Forks column in admin repo list (go-gitea#3969) * Add Environment Variables to Docker template (go-gitea#4012) * LFS: make HTTP auth period configurable (go-gitea#4035) * Add config path as an optionial flag when changing pass via CLI (go-gitea#4184) * Refactor User Settings sections (go-gitea#3900) * Allow square brackets in external issue patterns (go-gitea#3408) * Add Attachment API (go-gitea#3478) * Add EnableTimetracking option to app settings (go-gitea#3719) * Add config option to enable or disable log executed SQL (go-gitea#3726) * Shows total tracked time in issue and milestone list (go-gitea#3341) * TRANSLATION * Improve English grammar and consistency (go-gitea#3614) * DEPLOYMENT * Allow Gitea to run as different USER in Docker (go-gitea#3961) * Provide compressed release binaries (go-gitea#3991) * Sign release binaries (go-gitea#4188)

jonasfranz added 2 commits May 15, 2018 22:37

Add support for U2F

008a62e

Signed-off-by: Jonas Franz <[email protected]>

Add vendor library

a72944b

Add missing translations Signed-off-by: Jonas Franz <[email protected]>

techknowlogick added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label May 15, 2018

Minor improvements

18b3f09

Signed-off-by: Jonas Franz <[email protected]>

bkcsoft added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label May 15, 2018

jonasfranz added 2 commits May 16, 2018 15:35

Add U2F support for Firefox, Chrome (Android) by introducing a custom…

acf6728

… JS library Add U2F error handling Signed-off-by: Jonas Franz <[email protected]>

Merge branch 'master' into u2f

1966eb6

lunny added this to the 1.x.x milestone May 16, 2018

jonasfranz added 5 commits May 16, 2018 20:42

Merge branch 'master' into u2f

bf0aae7

Add U2F login page to OAuth

60f0ae7

Signed-off-by: Jonas Franz <[email protected]>

Merge remote-tracking branch 'onion/u2f' into u2f

0dcda4d

Merge branch 'master' into u2f

bc68bef

# Conflicts: # routers/user/setting.go

Move U2F user settings to a separate file

2c8120d

Signed-off-by: Jonas Franz <[email protected]>

jonasfranz mentioned this pull request May 17, 2018

Support FIDO U2F over USB and NFC. #1024

Closed

jonasfranz added 2 commits May 17, 2018 14:47

Add unit tests for u2f model

77a4d04

Renamed u2f table name Signed-off-by: Jonas Franz <[email protected]>

Fix problems caused by refactoring

bd47db7

Signed-off-by: Jonas Franz <[email protected]>

lafriks modified the milestones: 1.x.x, 1.5.0 May 17, 2018

lafriks added the type/changelog Adds the changelog for a new Gitea version label May 17, 2018

techknowlogick reviewed May 18, 2018

View reviewed changes

Add U2F documentation

506fbde

Signed-off-by: Jonas Franz <[email protected]>

bkcsoft added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 18, 2018

Merge branch 'master' into u2f

7cc9eb4

lafriks reviewed May 18, 2018

View reviewed changes

genofire reviewed May 18, 2018

View reviewed changes

jonasfranz added 5 commits May 19, 2018 10:52

Merge branch 'master' into u2f

20a817c

Remove not needed console.log-s

f8e44a5

Signed-off-by: Jonas Franz <[email protected]>

Merge remote-tracking branch 'onion/u2f' into u2f

0270ce6

Add default values to app.ini.sample

66552e7

Add FIDO U2F to comparison Signed-off-by: Jonas Franz <[email protected]>

Merge branch 'master' into u2f

378b921

bkcsoft added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 19, 2018

lafriks merged commit 951309f into go-gitea:master May 19, 2018

jonasfranz deleted the u2f branch May 19, 2018 14:24

go-gitea locked and limited conversation to collaborators Nov 24, 2020

delvh removed the type/changelog Adds the changelog for a new Gitea version label Oct 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for FIDO U2F #3971

Add support for FIDO U2F #3971

jonasfranz commented May 15, 2018 •

edited

Loading

codecov-io commented May 15, 2018 •

edited

Loading

jonasfranz commented May 16, 2018

techknowlogick commented May 18, 2018

techknowlogick May 18, 2018

jonasfranz May 18, 2018

jonasfranz commented May 18, 2018 •

edited

Loading

techknowlogick commented May 18, 2018

lafriks May 18, 2018

genofire left a comment

genofire May 18, 2018

genofire May 18, 2018

genofire May 18, 2018

jonasfranz May 19, 2018

genofire May 18, 2018

genofire May 18, 2018

lafriks commented May 19, 2018

webjoel commented May 21, 2018

jonasfranz commented May 21, 2018 via email

lafriks commented May 21, 2018

TheAssassin commented Jun 25, 2018

jonasfranz commented Jun 26, 2018

Add support for FIDO U2F #3971

Add support for FIDO U2F #3971

Conversation

jonasfranz commented May 15, 2018 • edited Loading

Requirements

Video example

TODO

iOS

codecov-io commented May 15, 2018 • edited Loading

Codecov Report

jonasfranz commented May 16, 2018

techknowlogick commented May 18, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonasfranz commented May 18, 2018 • edited Loading

techknowlogick commented May 18, 2018

Choose a reason for hiding this comment

genofire left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lafriks commented May 19, 2018

webjoel commented May 21, 2018

jonasfranz commented May 21, 2018 via email

lafriks commented May 21, 2018

TheAssassin commented Jun 25, 2018

jonasfranz commented Jun 26, 2018

jonasfranz commented May 15, 2018 •

edited

Loading

codecov-io commented May 15, 2018 •

edited

Loading

jonasfranz commented May 18, 2018 •

edited

Loading