28 lines
927 B
PHP
28 lines
927 B
PHP
<?php
|
|
|
|
namespace App\Support\Webauthn;
|
|
|
|
use RuntimeException;
|
|
use Webauthn\Counter\CounterChecker;
|
|
use Webauthn\CredentialRecord;
|
|
|
|
/**
|
|
* Counter check that tolerates authenticators which don't support a signature counter
|
|
* (platform authenticators / synchronized passkeys always report 0): a current counter
|
|
* of 0 is accepted, while a non-zero counter must strictly increase — keeping the
|
|
* cloned-authenticator / rollback detection for keys that do count.
|
|
*/
|
|
class ZeroTolerantCounterChecker implements CounterChecker
|
|
{
|
|
public function check(CredentialRecord $credentialRecord, int $currentCounter): void
|
|
{
|
|
if ($currentCounter === 0) {
|
|
return; // counter unsupported by this authenticator
|
|
}
|
|
|
|
if ($currentCounter <= $credentialRecord->counter) {
|
|
throw new RuntimeException('Invalid WebAuthn signature counter (possible cloned authenticator).');
|
|
}
|
|
}
|
|
}
|