5.2.5

Release Notes for 5.2.5

5.2.x bugfix release (patch)

5.2.5

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 820: fix: enforce HTTPS scheme check in CheckAllowedOrigins fallback path thanks to @Spomky

5.2.4

Release Notes for 5.2.4

Security Fix

• Fixed origin validation bypass in CheckAllowedOrigins (GHSA-f7pm-6hr8-7ggm, CWE-346, CVSS 5.4)

  When allowed_origins was configured, CheckAllowedOrigins reduced URL origins to their host component only, ignoring scheme and port. This allowed a request from a different port (or scheme) to pass origin validation, violating the WebAuthn Level 2 spec requirement for exact origin matching.

  CheckAllowedOrigins now performs full origin comparison (scheme + host + port) with default port normalization (443 for HTTPS, 80 for HTTP). Origins configured without a scheme are still matched by host only for backward compatibility.

  Reported by @dorakemon.

Upgrade

composer update web-auth/webauthn-framework
# or
composer update web-auth/webauthn-lib web-auth/webauthn-symfony-bundle

4.9.3

Release Notes for 4.9.3

4.9.x bugfix release (patch)

4.9.3

• Total issues resolved: 0

• Total pull requests resolved: 1

• Total contributors: 1

• 807: AuthenticatorAssertionResponseValidator: Add missing word from deprecation message thanks to @reedy

5.2.3

Release Notes for 5.2.3

5.2.x bugfix release (patch)

5.2.3

• Total issues resolved: 0
• Total pull requests resolved: 2
• Total contributors: 1

bug

• 793: fix: set trust anchor when validating certificate path to support intermediate CA certificates thanks to @Spomky
• 790: fix: use spomky-labs/pki-framework to replace native php openssl functions for attestation statements (backport to 5.2.x) thanks to @Spomky

5.2.2

Release Notes for 5.2.2

5.2.x bugfix release (patch)

5.2.2

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 709: Update PublicKeyCredentialSource.orm.xml thanks to @Spomky

5.2.1

Release Notes for 5.2.1

5.2.x bugfix release (patch)

5.2.1

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 708: Add user provider configuration for Webauthn authentication thanks to @Spomky

5.2.0

Release Notes for 5.2.0

Feature release (minor)

5.2.0

• Total issues resolved: 6
• Total pull requests resolved: 5
• Total contributors: 4

enhancement

• 704: Add WebAuthn extensions and integrate PRF handling logic thanks to @Spomky
• 693: Add Webauthn Badge support thanks to @Spomky
• 690: Add origin validation logic and tests for WebAuthn thanks to @Spomky
• 673: [Stimulus/Symfony UX] Allow a remember-me checkbox at login (or document it, if it already works somehow) thanks to @spackmat
• 616: CSRF Support thanks to @Spomky
• 426: Better Authentication Extensions thanks to @Spomky
• 393: Support Android's FIDO2 origin thanks to @giann

DX

• 702: Deprecate DoctrineCredentialSourceRepository in Symfony. thanks to @Spomky

DX,UX

• 701: Refactor and improve Webauthn handling, tests, and configs. thanks to @Spomky

bug

• 680: Column publicKeyCredentialId used in key specification without a key length thanks to @leofeyer

DX,enhancement

• 460: Passport and Badges thanks to @Spomky

5.1.3

Release Notes for 5.1.3

5.1.x bugfix release (patch)

5.1.3

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 698: Restore compatibility with Doctrine DBAL version 3 thanks to @ausi

5.1.2

Release Notes for 5.1.2

5.1.x bugfix release (patch)

5.1.2

• Total issues resolved: 2
• Total pull requests resolved: 5
• Total contributors: 3

bug

• 696: Malformed phpdoc tag in PublicKeyCredentialEntity thanks to @Spomky
• 695: Bugs/index length thanks to @Spomky
• 694: Fix trust path handling and improve assertions thanks to @Spomky and @Morthy
• 687: Update WebAuthn method calls to use object parameters thanks to @Spomky

DX

• 688: Add validation for missing "web-token/jwt-library" dependency thanks to @Spomky and @alexz707

5.1.1

Release Notes for 5.1.1

5.1.x bugfix release (patch)

5.1.1

• Total issues resolved: 0

• Total pull requests resolved: 2

• Total contributors: 1

• 678: Set a length limit for publicKeyCredentialId field thanks to @Spomky

• 677: Update build process and dependency versions thanks to @Spomky