Upgrade FIDO2 and fix Authorize button on iOS

CHANGELOG.md

@@ -1,7 +1,19 @@
 # Change Log
+## 2.4.0
 
-## 2.2.0 (Not released)
+   * Fixed: issue in the 'Authorize' button don't show on Safari Mobile.
-   * Added: MFA_REDIRECT_AFTER_REGISTRATION settings parameter 
+   * Upgrade to FIDO2 0.9.2, to fix issue with Windows 11.
+   * Fixed: Minor Typos.
+
+
+## 2.3.0
+   * Fixed: A missing import Thanks @AndreasDickow
+   * Fixed: `MFA.html` now call `{{block.super}}` for head and content blocks, thanks @mnelson4
+   * Added: #55 introduced `mfa_base.html` which will be extended by `MFA.html` for better styling 
+
+## 2.2.0
+   * Added: MFA_REDIRECT_AFTER_REGISTRATION settings parameter
+   * Fixed: Deprecation error for NULBooleanField
 
 ## 2.1.2
   * Fixed: Getting timestamp on Python 3.7 as ("%s") is raising an exception
@@ -9,7 +21,7 @@
 
 
 ## 2.1.1
-  * Fixed: FIDO2 version in requirments.txt file.
+  * Fixed: FIDO2 version in requirements.txt file.
   
 ## 2.1.0
    * Added Support for Touch ID for Mac OSx and iOS 14 on Safari

README.md

@@ -60,9 +60,9 @@ Depends on
    'mfa',
    '......')
    ```
-1. Collect Static Files
+2. Collect Static Files
 `python manage.py collectstatic`
-1. Add the following settings to your file
+3. Add the following settings to your file
 
    ```python 
    MFA_UNALLOWED_METHODS=()   # Methods that shouldn't be allowed for the user
@@ -95,7 +95,7 @@ Depends on
     * Starting version 1.7.0, Key owners can be specified.
     * Starting version 2.2.0
         * Added: `MFA_SUCCESS_REGISTRATION_MSG` & `MFA_REDIRECT_AFTER_REGISTRATION`
-1. Break your login function
+4. Break your login function
 
    Usually your login function will check for username and password, log the user in if the username and password are correct and create the user session, to support mfa, this has to change
    
@@ -115,7 +115,7 @@ Depends on
             return log_user_in(request,username=user.username) 
             #log_user_in is a function that handles creatung user session, it should be in the setting file as MFA_CALLBACK
      ```
-1. Add mfa to urls.py
+5. Add mfa to urls.py
    ```python 
    import mfa
    import mfa.TrustedDevice
@@ -126,14 +126,15 @@ Depends on
    '....',
     ]
     ```
-1. Provide `mfa_auth_base.html` in your templaes with block called 'head' and 'content'
+6. Provide `mfa_auth_base.html` in your templates with block called 'head' and 'content', The template will be included during the user login, the template shall be close to the login template.
-    The template will be included during the user login.
     If you will use Email Token method, then you have to provide template named `mfa_email_token_template.html` that will content the format of the email with parameter named `user` and `otp`.
-1. To match the look and feel of your project, MFA includes `base.html` but it needs blocks named `head` & `content` to added its content to it.
+7. To match the look and feel of your project, MFA includes `base.html` but it needs blocks named `head` & `content` to added its content to it.
-1. Somewhere in your app, add a link to 'mfa_home'
+   **Note:** Starting v2.3.0, a new template `mfa_base.html` is introduced, this template is used by `MFA.html` so you can control the styling better and current `mfa_base.html` extends `base.html`
+8. Somewhere in your app, add a link to 'mfa_home'
 ```<li><a href="{% url 'mfa_home' %}">Security</a> </li>```
 
-For Example, See https://github.com/mkalioby/AutoDeploy/commit/5f1d94b1804e0aa33c79e9e8530ce849d9eb78cc in AutDeploy Project
+
+For Example, See 'example' app
 
 # Going Passwordless
 
@@ -182,6 +183,8 @@ function some_func() {
 * [swainn](https://github.com/swainn)
 * [unramk](https://github.com/unramk)
 * [willingham](https://github.com/willingham)
+* [AndreasDickow](https://github.com/AndreasDickow)
+* [mnelson4](https://github.com/mnelson4)
 
 
  # Security contact information

example/example/auth.py

@@ -27,8 +27,4 @@ def create_session(request,username):
 
 def logoutView(request):
     logout(request)
-    return  render(request,"logout.html",{})
+    return  render(request,"logout.html",{})
-
-def register(request):
-    if request.method == "GET":
-        return

example/example/settings.py

@@ -25,7 +25,7 @@ SECRET_KEY = '#9)q!_i3@pr-^3oda(e^3$x!kq3b4f33#5l@+=+&vuz+p6gb3g'
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
 
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS = ['*']
 
 
 # Application definition
@@ -146,5 +146,5 @@ MFA_SUCCESS_REGISTRATION_MSG="Go to Home"
 TOKEN_ISSUER_NAME="PROJECT_NAME"      #TOTP Issuer name
 
 U2F_APPID="https://localhost"    #URL For U2F
-FIDO_SERVER_ID=u"localhost"      # Server rp id for FIDO2, it the full domain of your project
+FIDO_SERVER_ID=u"local.mkalioby.com"      # Server rp id for FIDO2, it the full domain of your project
-FIDO_SERVER_NAME=u"PROJECT_NAME"
+FIDO_SERVER_NAME=u"TestApp"

example/example/templates/login.html

@@ -17,6 +17,7 @@
 
   <!-- Custom styles for this template-->
   <link href="{% static 'css/sb-admin.css'%}" rel="stylesheet">
+
 </head>
 
 <body class="bg-dark">
@@ -28,6 +29,7 @@
           {% if invalid %}
               <div class="alert alert-danger">Invalid Username or password</div>
           {% endif %}
+        <form action="{% url 'login' %}" method="post">
             {% csrf_token %}
           <div class="form-group">
             <div class="form-label-group">
@@ -35,9 +37,14 @@
               <label for="inputUsername">Username</label>
             </div>
           </div>
+          <div class="form-group">
+            <div class="form-label-group">
+              <input type="password" id="inputPassword"  name="password" class="form-control" placeholder="Password" required="required">
+              <label for="inputPassword">Password</label>
+            </div>
+          </div>
 
-
+          <button class="btn btn-primary btn-block" type="submit">Login</button>
-          <button class="btn btn-primary btn-block" type="button" onclick="authen()">Login</button>
         </form>
       </div>
     </div>
@@ -49,7 +56,7 @@
 
   <!-- Core plugin JavaScript-->
   <script src="{% static 'vendor/jquery-easing/jquery.easing.min.js'%}"></script>
-{% include 'FIDO2/login.html' %}
+
 </body>
 
 </html>

example/example/templates/mfa_auth_base.html

@@ -28,6 +28,7 @@
       <div class="card-header">Login</div>
       <div class="card-body">
     {% block content %}
+
   {% endblock %}
   </div>
    </div>

mfa/FIDO2.py

@@ -80,7 +80,6 @@ def start(request):
     """Start Registeration a new FIDO Token"""
     context = csrf(request)
     context.update(get_redirect_url())
-    context["mfa_invoke"] = True
     return render(request, "FIDO2/Add.html", context)
 
 
@@ -98,8 +97,8 @@ def auth(request):
 
 def authenticate_begin(request):
     server = getServer()
-    #credentials = getUserCredentials(request.session.get("base_username", request.user.username))
+    credentials = getUserCredentials(request.session.get("base_username", request.user.username))
-    auth_data, state = server.authenticate_begin()
+    auth_data, state = server.authenticate_begin(credentials)
     request.session['fido_state'] = state
     return HttpResponse(cbor.encode(auth_data), content_type = "application/octet-stream")
 
@@ -108,7 +107,7 @@ def authenticate_begin(request):
 def authenticate_complete(request):
     try:
         credentials = []
-        username = request.session.get("base_username", request.POST.get("username",request.user.username))
+        username = request.session.get("base_username", request.user.username)
         server = getServer()
         credentials = getUserCredentials(username)
         data = cbor.decode(request.body)

mfa/U2F.py

@@ -12,6 +12,7 @@ from django.conf import settings
 from django.http import HttpResponse
 from .models import *
 from .views import login
+from .Common import get_redirect_url
 import datetime
 from django.utils import timezone
 

mfa/__init__.py

@@ -1 +1 @@
-__version__="2.2.0b1"
+__version__="2.2.0"

mfa/migrations/0011_auto_20210530_0622.py

@@ -0,0 +1,18 @@
+# Generated by Django 2.2 on 2021-05-30 06:22
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mfa', '0010_auto_20201110_0557'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='user_keys',
+            name='owned_by_enterprise',
+            field=models.BooleanField(blank=True, default=None, null=True),
+        ),
+    ]

mfa/models.py

@@ -15,7 +15,7 @@ class User_Keys(models.Model):
     enabled=models.BooleanField(default=True)
     expires=models.DateTimeField(null=True,default=None,blank=True)
     last_used=models.DateTimeField(null=True,default=None,blank=True)
-    owned_by_enterprise=models.NullBooleanField(default=None,null=True,blank=True)
+    owned_by_enterprise=models.BooleanField(default=None,null=True,blank=True)
 
     def save(self, force_insert=False, force_update=False, using=None, update_fields=None):
         if self.key_type == "Trusted Device" and self.properties.get("signature","") == "":

mfa/templates/FIDO2/Add.html

@@ -34,16 +34,16 @@
       if (res["status"] =='OK')
             $("#res").html("<div class='alert alert-success'>Registered Successfully, <a href='{{redirect_html}}'> {{reg_success_msg}}</a></div>")
         else
-            $("#res").html("<div class='alert alert-danger'>Registeration Failed as " + res["message"] + ", <a href='javascript:void(0)' onclick='begin_reg()'> try again or <a href='{% url 'mfa_home' %}'> Go to Security Home</a></div>")
+            $("#res").html("<div class='alert alert-danger'>Registration Failed as " + res["message"] + ", <a href='javascript:void(0)' onclick='begin_reg()'> try again or <a href='{% url 'mfa_home' %}'> Go to Security Home</a></div>")
 
 
     }, function(reason) {
-       $("#res").html("<div class='alert alert-danger'>Registeration Failed as " +reason +", <a href='javascript:void(0)' onclick='begin_reg()'> try again </a> or <a href='{% url 'mfa_home' %}'> Go to Security Home</a></div>")
+       $("#res").html("<div class='alert alert-danger'>Registration Failed as " +reason +", <a href='javascript:void(0)' onclick='begin_reg()'> try again </a> or <a href='{% url 'mfa_home' %}'> Go to Security Home</a></div>")
     })
     }
     $(document).ready(function (){
         ua=new UAParser().getResult()
-        if (ua.browser.name == "Safari")
+        if (ua.browser.name == "Safari" || ua.browser.name == "Mobile Safari" )
         {
                 $("#res").html("<button class='btn btn-success' onclick='begin_reg()'>Start...</button>")
         }

mfa/templates/FIDO2/fido2_auth.html

@@ -1,71 +0,0 @@
-{%  load static %}
-<script type="application/javascript" src="{% static 'mfa/js/cbor.js' %}"></script>
-<script type="application/javascript" src="{% static 'mfa/js/ua-parser.min.js' %}"></script>
-
-<script type="text/javascript">
-        function authen()
-        {
-                         fetch('{% url 'fido2_begin_auth' %}', {
-      method: 'GET',
-    }).then(function(response) {
-      if(response.ok) return response.arrayBuffer();
-      throw new Error('No credential available to authenticate!');
-    }).then(CBOR.decode).then(function(options) {
-        console.log(options)
-      return navigator.credentials.get(options);
-    }).then(function(assertion) {
-        res=CBOR.encode({
-          "credentialId": new Uint8Array(assertion.rawId),
-          "authenticatorData": new Uint8Array(assertion.response.authenticatorData),
-          "clientDataJSON": new Uint8Array(assertion.response.clientDataJSON),
-          "signature": new Uint8Array(assertion.response.signature)
-        });
-
-      return fetch('{% url 'fido2_complete_auth' %}', {
-
-        method: 'POST',
-        headers: {'Content-Type': 'application/cbor'},
-        body:res,
-
-      }).then(function (response) {if (response.ok) return res = response.json()}).then(function (res) {
-          if (res.status=="OK")
-          {
-              $("#msgdiv").addClass("alert alert-success").removeClass("alert-danger")
-             $("#msgdiv").html("Verified....please wait")
-          {%  if mode == "auth" %}
-          window.location.href=res.redirect;
-          {% elif mode == "recheck" %}
-              mfa_success_function();
-          {% endif %}
-          }
-          else {
-              $("#msgdiv").addClass("alert alert-danger").removeClass("alert-success")
-                $("#msgdiv").html("Verification Failed as " + res.message + ", <a href='javascript:void(0)' onclick='authen())'> try again</a> or <a href='javascript:void(0)' onclick='history.back()'> Go Back</a>")
-
-              {%  if mode == "auth" %}
-
-              {% elif mode == "recheck" %}
-
-                mfa_failed_function();
-              {% endif %}
-          }
-      })
-
-                 })
-
-        }
-    $(document).ready(function () {
-        if (location.protocol != 'https:') {
-            $("#main_paragraph").addClass("alert alert-danger")
-            $("#main_paragraph").html("FIDO2 must work under secure context")
-        } else {
-            {% if mfa_invoke %}
-            ua=new UAParser().getResult()
-            if (ua.browser.name == "Safari")
-                $("#res").html("<button class='btn btn-success' onclick='authen()'>Authenticate...</button>")
-            else
-                authen()
-            {% endif %}
-        }
-    });
-</script>

mfa/templates/FIDO2/login.html

@@ -1 +0,0 @@
-{% include 'FIDO2/fido2_auth.html' %}

mfa/templates/FIDO2/recheck.html

@@ -1,4 +1,6 @@
-
+{%  load static %}
+<script type="application/javascript" src="{% static 'mfa/js/cbor.js' %}"></script>
+<script type="application/javascript" src="{% static 'mfa/js/ua-parser.min.js' %}"></script>
 <div class="row">
 
 <div class="col-sm-10 col-sm-offset-1 col-xs-12 col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
@@ -45,4 +47,71 @@
 </div>
 </div>
 
-{% include 'FIDO2/fido2_auth.html' %}
+    <script type="text/javascript">
+        function authen()
+        {
+                         fetch('{% url 'fido2_begin_auth' %}', {
+      method: 'GET',
+    }).then(function(response) {
+      if(response.ok) return response.arrayBuffer();
+      throw new Error('No credential available to authenticate!');
+    }).then(CBOR.decode).then(function(options) {
+        console.log(options)
+      return navigator.credentials.get(options);
+    }).then(function(assertion) {
+        res=CBOR.encode({
+          "credentialId": new Uint8Array(assertion.rawId),
+          "authenticatorData": new Uint8Array(assertion.response.authenticatorData),
+          "clientDataJSON": new Uint8Array(assertion.response.clientDataJSON),
+          "signature": new Uint8Array(assertion.response.signature)
+        });
+
+      return fetch('{% url 'fido2_complete_auth' %}', {
+
+        method: 'POST',
+        headers: {'Content-Type': 'application/cbor'},
+        body:res,
+
+      }).then(function (response) {if (response.ok) return res = response.json()}).then(function (res) {
+          if (res.status=="OK")
+          {
+              $("#msgdiv").addClass("alert alert-success").removeClass("alert-danger")
+             $("#msgdiv").html("Verified....please wait")
+          {%  if mode == "auth" %}
+          window.location.href=res.redirect;
+          {% elif mode == "recheck" %}
+              mfa_success_function();
+          {% endif %}
+          }
+          else {
+              $("#msgdiv").addClass("alert alert-danger").removeClass("alert-success")
+                $("#msgdiv").html("Verification Failed as " + res.message + ", <a href='javascript:void(0)' onclick='authen())'> try again</a> or <a href='javascript:void(0)' onclick='history.back()'> Go Back</a>")
+
+              {%  if mode == "auth" %}
+
+              {% elif mode == "recheck" %}
+
+                mfa_failed_function();
+              {% endif %}
+          }
+      })
+
+                 })
+
+        }
+    $(document).ready(function () {
+        if (location.protocol != 'https:') {
+            $("#main_paragraph").addClass("alert alert-danger")
+            $("#main_paragraph").html("FIDO2 must work under secure context")
+        } else {
+            ua=new UAParser().getResult()
+            if (ua.browser.name == "Safari" || ua.browser.name == "Mobile Safari" )
+                $("#res").html("<button class='btn btn-success' onclick='authen()'>Authenticate...</button>")
+            else
+                authen()
+        }
+    });
+
+
+
+    </script>

mfa/templates/MFA.html

@@ -1,6 +1,7 @@
-{% extends "base.html" %}
+{% extends "mfa_base.html" %}
 {% load static %}
 {% block head %}
+{{block.super}}
     <script type="text/javascript">
     function confirmDel(id) {
         $.ajax({
@@ -39,6 +40,7 @@
     <script src="{% static 'mfa/js/bootstrap-toggle.min.js'%}"></script>
 {% endblock %}
 {% block content %}
+{{block.super}}
     <br/>
     <br/>
     <div class="container">

mfa/templates/mfa_base.html

@@ -0,0 +1,7 @@
+{% extends 'base.html' %}
+{% block head %}
+{{ block.super }}
+{% endblock %}
+{% block content %}
+{{ block.super }}
+{% endblock %}

mfa/totp.py

@@ -1,6 +1,7 @@
 from django.shortcuts import render
 from django.views.decorators.cache import never_cache
 from django.http import HttpResponse
+from .Common import get_redirect_url
 from .models import *
 from django.template.context_processors import csrf
 import simplejson

setup.py

@@ -4,7 +4,7 @@ from setuptools import find_packages, setup
 
 setup(
     name='django-mfa2',
-    version='2.2.0b2    ',
+    version='2.4.0',
     description='Allows user to add 2FA to their accounts',
     long_description=open("README.md").read(),
     long_description_content_type="text/markdown",
@@ -24,19 +24,21 @@ setup(
         'ua-parser',
         'user-agents',
         'python-jose',
-        'fido2 == 0.9.1',
+        'fido2 == 0.9.2',
         'jsonLookup'
       ],
     python_requires=">=3.5",
     include_package_data=True,
     zip_safe=False, # because we're including static files
     classifiers=[
-        "Development Status :: 4 - Beta",
+        "Development Status :: 5 - Production/Stable",
         "Environment :: Web Environment",
         "Framework :: Django",
         "Framework :: Django :: 2.0",
         "Framework :: Django :: 2.1",
         "Framework :: Django :: 2.2",
+        "Framework :: Django :: 3.0",
+        "Framework :: Django :: 3.1",
         "Intended Audience :: Developers",
         "Operating System :: OS Independent",
         "Programming Language :: Python",