Repository navigation
Sync fork with latest WebGoat/WebGoat main - #45
Merged
Merged
Conversation
New lesson on passkeys/security keys and the vulnerabilities that arise from incomplete server-side verification of WebAuthn ceremonies: - Registration assignment: GoatBank binds a new credential to the account named by a client-supplied (and predictable) user handle. - Authentication assignment: GoatBank verifies the assertion signature but never compares the challenge, so a leaked login request can be replayed. - Quiz on other pitfalls and a mitigation page. - Bonus assignment: register and sign in with a real roaming security key via the browser WebAuthn API against a fully verifying implementation (packed / fido-u2f attestation, single-use challenges, signCount checks). Includes a minimal CBOR codec and a virtual authenticator so the GoatBank assignments work without hardware. Covered by unit, REST integration and Playwright tests; the UI test uses a CDP virtual CTAP2/USB authenticator.
Desktop users need ZAP-launched Firefox to reach WebGoat through the proxy and use the supplied browser bookmarks. Closes: WebGoat#2563
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2e38dbaf-314a-4291-956f-e15daa365aa0
There was a problem hiding this comment.
🟡 Changes recommended
The secure flow contains HTML injection, non-atomic challenge consumption, and malformed attestation handling issues.
6 open findings
What changed in this PR
Synchronizes the fork with upstream through e7b13136, adding the A7 WebAuthn lesson, desktop ZAP proxy setup, and the next snapshot version.
Changes:
- Adds WebAuthn lessons, assignments, documentation, and tests.
- Configures Firefox and ZAP proxying in the desktop image.
- Advances the project to
2026.6-SNAPSHOT.
| File | Description |
|---|---|
pom.xml |
Advances snapshot version. |
Dockerfile_desktop |
Installs and configures Firefox. |
config/desktop/WebGoat.txt |
Documents proxied browser startup. |
config/desktop/start_zap.sh |
Configures PAC and Firefox for ZAP. |
config/desktop/firefox-policies.json |
Adds homepage and bookmarks policies. |
src/main/java/org/owasp/webgoat/container/WebSecurityConfig.java |
Permits anonymous PAC access. |
src/main/java/org/owasp/webgoat/container/ProxyAutoConfigController.java |
Serves the ZAP PAC file. |
src/main/java/org/owasp/webgoat/lessons/webauthn/Cbor.java |
Implements minimal CBOR encoding and parsing. |
src/main/java/org/owasp/webgoat/lessons/webauthn/GoatBankCeremonyEndpoints.java |
Provides simulated vulnerable ceremonies. |
src/main/java/org/owasp/webgoat/lessons/webauthn/SecurityKeyCeremonyEndpoints.java |
Implements real-key registration options and verification. |
src/main/java/org/owasp/webgoat/lessons/webauthn/VirtualAuthenticator.java |
Simulates a WebAuthn authenticator. |
src/main/java/org/owasp/webgoat/lessons/webauthn/WebAuthn.java |
Registers the A7 lesson. |
src/main/java/org/owasp/webgoat/lessons/webauthn/WebAuthnAuthenticationAssignment.java |
Adds the replay assignment. |
src/main/java/org/owasp/webgoat/lessons/webauthn/WebAuthnLessonState.java |
Stores per-user credentials and fixtures. |
src/main/java/org/owasp/webgoat/lessons/webauthn/WebAuthnQuiz.java |
Implements quiz evaluation. |
src/main/java/org/owasp/webgoat/lessons/webauthn/WebAuthnRegistrationAssignment.java |
Adds the account-binding assignment. |
src/main/java/org/owasp/webgoat/lessons/webauthn/WebAuthnSecurityKeyAssignment.java |
Verifies real-key assertions. |
src/main/java/org/owasp/webgoat/lessons/webauthn/WebAuthnSupport.java |
Provides WebAuthn parsing and cryptography. |
src/main/resources/lessons/webauthn/css/webauthn.css |
Styles the lesson interface. |
src/main/resources/lessons/webauthn/html/WebAuthn.html |
Defines lesson pages and forms. |
src/main/resources/lessons/webauthn/i18n/WebGoatLabels.properties |
Adds feedback and hints. |
src/main/resources/lessons/webauthn/js/webauthn.js |
Drives browser ceremony flows. |
src/main/resources/lessons/webauthn/js/questions_webauthn.json |
Defines quiz questions. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_intro.adoc |
Introduces WebAuthn. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_concepts.adoc |
Explains core concepts. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_registration.adoc |
Documents registration. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_registration_assignment.adoc |
Explains the registration exercise. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_authentication.adoc |
Documents authentication. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_authentication_assignment.adoc |
Explains the replay exercise. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_pitfalls.adoc |
Describes implementation pitfalls. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_quiz.adoc |
Introduces the quiz. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_mitigation.adoc |
Documents secure implementation guidance. |
src/main/resources/lessons/webauthn/documentation/WebAuthn_securitykey.adoc |
Explains the real-key bonus. |
src/test/java/org/owasp/webgoat/lessons/webauthn/CborTest.java |
Tests CBOR and basic attestation parsing. |
src/test/java/org/owasp/webgoat/lessons/webauthn/WebAuthnLessonTest.java |
Tests assignment behavior. |
src/it/java/org/owasp/webgoat/integration/WebAuthnIntegrationTest.java |
Exercises the complete REST lesson flow. |
src/it/java/org/owasp/webgoat/integration/LabelAndHintIntegrationTest.java |
Includes WebAuthn hint validation. |
src/it/java/org/owasp/webgoat/playwright/webgoat/lessons/WebAuthnLessonUITest.java |
Tests lesson UI workflows. |
src/it/java/org/owasp/webgoat/playwright/webgoat/pages/lessons/WebAuthnLessonPage.java |
Adds WebAuthn page interactions. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+142
to
+145
| public Map<String, Object> capturedLoginOfJerry(RelyingParty rp) { | ||
| return capturedLogins.computeIfAbsent( | ||
| rp.origin(), | ||
| origin -> { |
Comment on lines
+119
to
+120
| .formatted(stored.credentialId(), stored.aaguid(), stored.attestation(), | ||
| authData.flagsDescription()) |
Comment on lines
+97
to
+98
| String expectedChallenge = (String) session.getAttribute(REGISTRATION_CHALLENGE); | ||
| session.removeAttribute(REGISTRATION_CHALLENGE); |
Comment on lines
+58
to
+59
| String expectedChallenge = (String) session.getAttribute(AUTHENTICATION_CHALLENGE); | ||
| session.removeAttribute(AUTHENTICATION_CHALLENGE); |
Comment on lines
+380
to
+384
| byte[] aaguidExtension = certificate.getExtensionValue(AAGUID_EXTENSION_OID); | ||
| if (aaguidExtension != null | ||
| && !Arrays.equals( | ||
| Arrays.copyOfRange(aaguidExtension, aaguidExtension.length - 16, aaguidExtension.length), | ||
| authData.aaguid())) { |
Comment on lines
+357
to
+358
| case "packed" -> verifyPacked(attStmt, authData, signedData); | ||
| case "fido-u2f" -> verifyFidoU2f(attStmt, authData, clientDataHash); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merge upstream
WebGoat/WebGoatmain throughe7b13136, preserving fork history.Upstream commits:
bf79d42echore: back to snapshot after v2026.5e3458572feat: add Security Keys & WebAuthn lesson (A7) (feat: add Security Keys & WebAuthn lesson (A7) WebGoat/WebGoat#2583)e7b13136fix(desktop): configure ZAP browser proxyNo fork-specific code modifications. Merge only after all PR checks pass.