Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def get_context_data(self, **kwargs):
ctx = super().get_context_data()
if 'webauthn_challenge' in self.request.session:
del self.request.session['webauthn_challenge']
challenge = generate_challenge(32)
self.request.session['webauthn_challenge'] = challenge
devices = [
device.webauthnuser for device in WebAuthnDevice.objects.filter(confirmed=True, user=self.request.user)
] + [
device.webauthnuser for device in U2FDevice.objects.filter(confirmed=True, user=self.request.user)
]
if devices:
webauthn_assertion_options = webauthn.WebAuthnAssertionOptions(
devices,
challenge
)
ad = webauthn_assertion_options.assertion_dict
ad['extensions'] = {
'appid': get_u2f_appid(self.request)
}
ctx['jsondata'] = json.dumps(ad)
ctx['form'] = self.form
return ctx
current_user = admin_users[email]
challenge = generate_random_string(32)
session['challenge'] = challenge
webauthn_user = webauthn.WebAuthnUser(
current_user['id'], # user ID
current_user['email'], # username
current_user['email'], # user display name
'', # icon url
current_user['known_keys'][0]['credential_id'],
current_user['known_keys'][0]['public_key'],
current_user['known_keys'][0]['sign_count'],
RP_ID)
webauthn_assertion_options = webauthn.WebAuthnAssertionOptions(
webauthn_user, challenge)
json_assertion_options = json.dumps(webauthn_assertion_options.assertion_dict)
# for some reason the allowCredentials ID is a string of bytes. No bueno for json.dumps
return render_template('request-security-key.html', assertion_options=json_assertion_options)
def mfaAssert(request):
if 'mfa_user_id' not in request.session:
return JsonResponse({'success': False, 'error': _('You need to log in first')})
if request.user.is_authenticated:
return JsonResponse({'success': False, 'error': _('You are already logged in')})
user = get_user_model().objects.get(id=request.session['mfa_user_id'])
challenge = generate_challenge(32)
request.session['challenge'] = challenge
webauthn_users = makeWebauthnUsers(user)
webauthn_assertion_options = webauthn.WebAuthnAssertionOptions(
webauthn_users, challenge)
return JsonResponse(webauthn_assertion_options.assertion_dict)
def get_context_data(self, **kwargs):
ctx = super().get_context_data()
if 'webauthn_challenge' in self.request.session:
del self.request.session['webauthn_challenge']
challenge = generate_challenge(32)
self.request.session['webauthn_challenge'] = challenge
devices = [
device.webauthnuser for device in WebAuthnDevice.objects.filter(confirmed=True, user=self.user)
] + [
device.webauthnuser for device in U2FDevice.objects.filter(confirmed=True, user=self.user)
]
if devices:
webauthn_assertion_options = webauthn.WebAuthnAssertionOptions(
devices,
challenge
)
ad = webauthn_assertion_options.assertion_dict
ad['extensions'] = {
'appid': get_u2f_appid(self.request)
}
ctx['jsondata'] = json.dumps(ad)
return ctx