fix: fix base64 padding (#381)

asbiin · Apr 19, 2022 · 6ce3783 · 6ce3783
1 parent bf6c54a
commit 6ce3783
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 9 deletions.
diff --git a/src/Auth/EloquentWebAuthnProvider.php b/src/Auth/EloquentWebAuthnProvider.php
@@ -54,9 +54,9 @@ public function retrieveByCredentials(array $credentials)
     {
         if ($this->isSignedChallenge($credentials)) {
             try {
-                $webauthnKey = (Webauthn::model())::where([
-                    'credentialId' => Base64UrlSafe::encode(Base64::decode($credentials['id'])),
-                ])->firstOrFail();
+                $webauthnKey = (Webauthn::model())::where('credentialId', Base64UrlSafe::encode(Base64::decode($credentials['id'])))
+                    ->orWhere('credentialId', Base64UrlSafe::encodeUnpadded(Base64::decode($credentials['id'])))
+                    ->firstOrFail();
 
                 return $this->retrieveById($webauthnKey->user_id);
             } catch (ModelNotFoundException $e) {

diff --git a/src/Services/Webauthn/CredentialRepository.php b/src/Services/Webauthn/CredentialRepository.php
@@ -111,12 +111,16 @@ public function getRegisteredKeys(User $user): array
      */
     private function model(string $credentialId): WebauthnKey
     {
-        return (Webauthn::model())::where(array_filter(
-            [
-                'user_id' => $this->guard()->guest() ? null : $this->guard()->id(),
-                'credentialId' => Base64UrlSafe::encode($credentialId),
-            ]
-        ))->firstOrFail();
+        return (Webauthn::model())::where(function ($query) {
+            if ($this->guard()->check()) {
+                $query->where('user_id', $this->guard()->id());
+            }
+        })
+        ->where(function ($query) use ($credentialId) {
+            $query->where('credentialId', Base64UrlSafe::encode($credentialId))
+                ->orWhere('credentialId', Base64UrlSafe::encodeUnpadded($credentialId));
+        })
+        ->firstOrFail();
     }
 
     /**