tomciopp
Does anyone know if Phoenix/Cowboy implements token binding? My guess would be no since it’s not well supported in browsers, but I could not find any information that would support or disprove this.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #phoenix_html
- #iex
- #graphql
- #ai
- #genstage
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First 7 of 7 Posts
tangui
I’m pretty sure it is not implemented: there’s just no interface to configure it with the OpenSSL library binding to Erlang (the OpenSSL version implementing Token Binding). (@voltone can probably confirm this.)
Also, since Chrome has removed support for it, my opinion is that it won’t see widespread adoption, ever. See:
Maybe you can tell us more: what are you trying to achieve with Token Binding?
tomciopp
Haha you’re probably the only other person on this forum who could guess why I’m looking into token binding. I’m refactoring/forking your wax library so that it is 100% compliant with the webauthn spec (fully tested). However, it looks like most people have just punted on the TokenBinding aspect which is understandable given its lack of adoption.
I’ll likely implement it properly as the spec dictates but leave it up the the end user whether they want to skip the TokenBinding validation step.
voltone
Right, the TLS extensions required are not supported by the ssl application.
tangui
It’s also possible to use it behind a reverse-proxy supporting Token Binding: https://tools.ietf.org/id/draft-ietf-tokbind-ttrp-05.html
Great! What do you mean by fully tested? I can’t have the FIDO2 official test suite working on Linux for 6 months already. I plan some maintenance work on Wax in the coming weeks.
Crowdhailer
How did the
fork/refactoringgo.I found this thread before a merged PR or anything that would say how it has gone.
tomciopp
Released as the
:webauthnpackage. GitHub - scalpel-software/webauthn: Authenticate users to your web application using public key cryptography by becoming a webauthn relying party · GitHubI need to write docs, and include a JS package before fully releasing a 1.0, but everything has been running in prod w/o a hitch. Need to take some time and fully finish this so that other people can use it without having to be a subject matter expert.
acrolink
Never heard if it.