WebAuthn CredentialID field needs to be increased in size #20530

zeripath · 2022-07-28T21:15:08Z

WebAuthn have updated their specification to set the maximum size of the
CredentialID to 1023 bytes. This is somewhat larger than our current
size and therefore we need to migrate.

The PR changes the struct to add CredentialIDBytes and migrates the CredentialID string
to the bytes field before another migration drops the old CredentialID field. Another migration
renames this field back.

Fix #20457

Signed-off-by: Andrew Thornton art27@cantab.net

WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. Fix go-gitea#20457 Signed-off-by: Andrew Thornton <art27@cantab.net>

zeripath · 2022-07-28T21:16:57Z

Yes this has a migration. I suggest we just port the back the unnecessary migration that is between these two and/or the associated PR.

jolheiser

LGTM, until next time 🤠

Gusted

@jolheiser You're just asking for problems 🙊

models/migrations/v221.go

wxiaoguang · 2022-07-29T10:02:32Z

LGTM, how about setting the length to a large-enough value, like 8000? There should be no difference between 1640 and 8000 on database side, then no worry about overflowing anymore.

zeripath · 2022-07-29T14:09:54Z

The field is indexed and is searched directly so it's potentially bad on db systems like MySQL which store the value directly within the index. I'm not sure if these would store the max string size eg. 8000 bytes or whether they'd just store the string. If it's just the string then it's no worse but I don't know.

The spec has written clearly that this is at most 1023 bytes - previously it wasn't very clear on this hence the change. I guess the question is are they likely to increase it? My suspicion is we'd get more forewarning in that case.

I think if they do increase it again we're probably gonna need to think again about how we implement this. It could be that at that point we'd need to be doing shasums of the credential id searching for that and then doing equality of the credential id - if only to keep the index from being too large.

zeripath · 2022-07-29T14:51:11Z

And in fact I think we've hit the problem I was referring to.

Looking at the tests I see:

       testlogger.go:78: 2022/07/29 14:18:52 ...ations/migrations.go:497:Migrate() [I] Migration[210]: v208 was completely broken - remigrate
        migration_test.go:299: 
            	Error Trace:	migration_test.go:299
            	            				migration_test.go:336
            	Error:      	Received unexpected error:
            	            	migrate: migration[210]: v208 was completely broken - remigrate failed: Error 1071: Specified key was too long; max key length is 3072 bytes
            	Test:       	TestMigrations/Migrate-mysql-1.6.4

Sigh I think we're going to need to do a bit more work here.

…bauthn-credential-field

Signed-off-by: Andrew Thornton <art27@cantab.net>

zeripath · 2022-07-29T19:02:06Z

OK I've had to do something a lot more horrible because of MySQL's index issue.

Signed-off-by: Andrew Thornton <art27@cantab.net>

Gusted

Small nit, otherwise L-gtm and verified migration on local instance.

models/auth/webauthn.go

Signed-off-by: Andrew Thornton <art27@cantab.net>

models/migrations/v223.go

models/migrations/v221_test.go

models/migrations/v223.go

6543 · 2022-07-30T13:24:58Z

🚀

…0530) WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. The PR changes the struct to add CredentialIDBytes and migrates the CredentialID string to the bytes field before another migration drops the old CredentialID field. Another migration renames this field back. Fix go-gitea#20457 Signed-off-by: Andrew Thornton <art27@cantab.net>

…20555) WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. The PR changes the struct to add CredentialIDBytes and migrates the CredentialID string to the bytes field before another migration drops the old CredentialID field. Another migration renames this field back. Fix #20457 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>

* giteaofficial/main: (29 commits) [skip ci] Updated translations via Crowdin Support localized README (go-gitea#20508) Clean up and fix clone button script (go-gitea#20415) Add disable download source configuration (go-gitea#20548) Fix default merge style (go-gitea#20564) Update login methods in package docs (go-gitea#20561) Add missing Tabs on organisation/package view (Frontport go-gitea#20539) (go-gitea#20540) [skip ci] Updated licenses and gitignores Add setting `SQLITE_JOURNAL_MODE` to enable WAL (go-gitea#20535) Rework file highlight rendering and fix yaml copy-paste (go-gitea#19967) Add new API endpoints for push mirrors management (go-gitea#19841) WebAuthn CredentialID field needs to be increased in size (go-gitea#20530) Add latest commit's SHA to content response (go-gitea#20398) Improve token and secret key generation docs (go-gitea#20387) [skip ci] Updated translations via Crowdin Rework raw file http header logic (go-gitea#20484) Update lunny/levelqueue to prevent NPE when reads are performed after close (go-gitea#20534) Added guidance on file to choose to download (go-gitea#20474) [skip ci] Updated translations via Crowdin Ensure that all unmerged files are merged when conflict checking (go-gitea#20528) ...

…0530) WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. The PR changes the struct to add CredentialIDBytes and migrates the CredentialID string to the bytes field before another migration drops the old CredentialID field. Another migration renames this field back. Fix go-gitea#20457 Signed-off-by: Andrew Thornton <art27@cantab.net>

zeripath added type/bug backport/v1.17 labels Jul 28, 2022

zeripath added this to the 1.18.0 milestone Jul 28, 2022

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jul 28, 2022

jolheiser approved these changes Jul 28, 2022

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jul 28, 2022

Gusted approved these changes Jul 28, 2022

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jul 28, 2022

6543 reviewed Jul 28, 2022

View reviewed changes

models/migrations/v221.go Outdated Show resolved Hide resolved

Merge remote-tracking branch 'origin/main' into fix-20457-increase-we…

8b0716b

…bauthn-credential-field

6543 mentioned this pull request Jul 29, 2022

Changelog v1.17.0 #20541

Merged

Move to use webauthnCredential CredentialID as bytes

46fced8

Signed-off-by: Andrew Thornton <art27@cantab.net>

zeripath added 6 commits July 29, 2022 20:10

fix test

919d517

Signed-off-by: Andrew Thornton <art27@cantab.net>

i hate our linter

248b5ce

Signed-off-by: Andrew Thornton <art27@cantab.net>

of course MSSQL has to be difficult

72cd759

Signed-off-by: Andrew Thornton <art27@cantab.net>

i hate our linter

25388aa

Signed-off-by: Andrew Thornton <art27@cantab.net>

and change the lookup function

3eb1d13

Signed-off-by: Andrew Thornton <art27@cantab.net>

and change the lookup function

da04731

Signed-off-by: Andrew Thornton <art27@cantab.net>

Gusted reviewed Jul 29, 2022

View reviewed changes

models/auth/webauthn.go Outdated Show resolved Hide resolved

separate the out the droptablecolumns into another migration

9f15fed

Signed-off-by: Andrew Thornton <art27@cantab.net>

zeripath commented Jul 29, 2022

View reviewed changes

models/migrations/v223.go Outdated Show resolved Hide resolved

Update models/migrations/v223.go

0e675c9

Update webauthn.go

7926dac

6543 reviewed Jul 30, 2022

View reviewed changes

models/migrations/v221_test.go Outdated Show resolved Hide resolved

nit

197c197

6543 reviewed Jul 30, 2022

View reviewed changes

models/migrations/v223.go Show resolved Hide resolved

Merge branch 'main' into fix-20457-increase-webauthn-credential-field

ebfa23a

6543 approved these changes Jul 30, 2022

View reviewed changes

Merge branch 'main' into fix-20457-increase-webauthn-credential-field

550160c

6543 merged commit e819da0 into go-gitea:main Jul 30, 2022

6543 mentioned this pull request Jul 30, 2022

WebAuthn CredentialID field needs to be increased in size (#20530) #20555

Merged

zeripath deleted the fix-20457-increase-webauthn-credential-field branch July 30, 2022 16:30

wxiaoguang added the backport/done All backports for this PR have been created label Aug 11, 2022

go-gitea locked and limited conversation to collaborators May 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WebAuthn CredentialID field needs to be increased in size #20530

WebAuthn CredentialID field needs to be increased in size #20530

zeripath commented Jul 28, 2022 •

edited

Loading

zeripath commented Jul 28, 2022

jolheiser left a comment

Gusted left a comment

wxiaoguang commented Jul 29, 2022

zeripath commented Jul 29, 2022

zeripath commented Jul 29, 2022

zeripath commented Jul 29, 2022

Gusted left a comment

6543 commented Jul 30, 2022

WebAuthn CredentialID field needs to be increased in size #20530

WebAuthn CredentialID field needs to be increased in size #20530

Conversation

zeripath commented Jul 28, 2022 • edited Loading

zeripath commented Jul 28, 2022

jolheiser left a comment

Choose a reason for hiding this comment

Gusted left a comment

Choose a reason for hiding this comment

wxiaoguang commented Jul 29, 2022

zeripath commented Jul 29, 2022

zeripath commented Jul 29, 2022

zeripath commented Jul 29, 2022

Gusted left a comment

Choose a reason for hiding this comment

6543 commented Jul 30, 2022

zeripath commented Jul 28, 2022 •

edited

Loading