tomciopp
Does anyone know if Phoenix/Cowboy implements token binding? My guess would be no since it’s not well supported in browsers, but I could not find any information that would support or disprove this.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Bringing learning, work and compliance together since 1987.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #blog-post
- #ai
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 7- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
tangui
I’m pretty sure it is not implemented: there’s just no interface to configure it with the OpenSSL library binding to Erlang (the OpenSSL version implementing Token Binding). (@voltone can probably confirm this.)
Also, since Chrome has removed support for it, my opinion is that it won’t see widespread adoption, ever. See:
Maybe you can tell us more: what are you trying to achieve with Token Binding?
tomciopp
Haha you’re probably the only other person on this forum who could guess why I’m looking into token binding. I’m refactoring/forking your wax library so that it is 100% compliant with the webauthn spec (fully tested). However, it looks like most people have just punted on the TokenBinding aspect which is understandable given its lack of adoption.
I’ll likely implement it properly as the spec dictates but leave it up the the end user whether they want to skip the TokenBinding validation step.
voltone
Right, the TLS extensions required are not supported by the ssl application.
tangui
It’s also possible to use it behind a reverse-proxy supporting Token Binding: https://tools.ietf.org/id/draft-ietf-tokbind-ttrp-05.html
Great! What do you mean by fully tested? I can’t have the FIDO2 official test suite working on Linux for 6 months already. I plan some maintenance work on Wax in the coming weeks.
Crowdhailer
How did the
fork/refactoringgo.I found this thread before a merged PR or anything that would say how it has gone.
tomciopp
Released as the
:webauthnpackage. GitHub - scalpel-software/webauthn: Authenticate users to your web application using public key cryptography by becoming a webauthn relying party · GitHubI need to write docs, and include a JS package before fully releasing a 1.0, but everything has been running in prod w/o a hitch. Need to take some time and fully finish this so that other people can use it without having to be a subject matter expert.
acrolink
Never heard if it.