30 lines
1.1 KiB
PHP
30 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace App\Support\Webauthn;
|
|
|
|
use RuntimeException;
|
|
use Webauthn\Counter\CounterChecker;
|
|
use Webauthn\CredentialRecord;
|
|
|
|
/**
|
|
* Counter check that tolerates authenticators which don't support a signature counter
|
|
* (platform authenticators / synchronized passkeys always report 0): a current counter
|
|
* of 0 is accepted, while a non-zero counter must strictly increase — keeping the
|
|
* cloned-authenticator / rollback detection for keys that do count.
|
|
*/
|
|
class ZeroTolerantCounterChecker implements CounterChecker
|
|
{
|
|
public function check(CredentialRecord $credentialRecord, int $currentCounter): void
|
|
{
|
|
// Tolerate 0 ONLY when the stored counter is also 0 (authenticator never counts).
|
|
// A 0 after a previously non-zero counter is a rollback/clone → reject.
|
|
if ($currentCounter === 0 && $credentialRecord->counter === 0) {
|
|
return;
|
|
}
|
|
|
|
if ($currentCounter <= $credentialRecord->counter) {
|
|
throw new RuntimeException('Invalid WebAuthn signature counter (possible cloned authenticator).');
|
|
}
|
|
}
|
|
}
|