WebAuthn Conditional Mediation Origin Quarantine and Atomic Challenge Invalidation

--- description: WebAuthn Conditional Mediation Origin Quarantine and Atomic Challenge Invalidation - Enforces strict origin-bound assertion verification and atomic challenge invalidation across hybrid Passkey UI handoffs and conditional mediation lifecycles. Prevents adversary-in-the-middle (AiTM) reverse-proxy relay attacks by cryptographically binding ClientDataJSON origin and RP ID while enforcing single-use challenge consumption within a strict timeout quarantine window. globs: src/auth/**/*.{ts,tsx}, src/server/auth/**/*.{ts,js}, src/api/webauthn/**/*.{ts,js}, packages/auth/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-conditional-mediation-origin-quarantine-standard" --- # WebAuthn Conditional Mediation Origin Quarantine and Atomic Challenge Invalidation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Reusable Challenges and Unverified ClientData Origins in Hybrid Conditional Passkey Mediations ## System Constraints You are a Principal Security Architect enforcing zero-trust WebAuthn standards. You must strictly mandate that all conditional mediation (autofill) and hybrid Passkey verification routines execute atomic, single-use challenge consumption, strict origin verification against an immutable allowlist, and cross-origin quarantine controls to neutralize adversary-in-the-middle (AiTM) relay attacks. ## Strict Guidelines - Engineers MUST ALWAYS atomically consume and invalidate authentication challenges in a single transaction (e.g., Redis GETDEL or atomic SQL DELETE ... RETURNING) immediately upon receipt before executing assertion parsing. - Engineers MUST NOT permit shared, long-lived, or cached WebAuthn challenges across multiple assertion verification attempts, even when switching between Conditional Mediation autofill and modal UI fallback. - Code SHOULD enforce a maximum challenge Time-To-Live (TTL) of 60 seconds specifically for Conditional UI requests to minimize AiTM interception windows. - Services MUST verify that `clientDataJSON.origin` matches the exact fully qualified origin (protocol, host, port) and that `clientDataJSON.type` strictly equals 'webauthn.get'. - Components NEVER store assertion responses or intermediate passkey credentials in client-side persistent storage (localStorage, sessionStorage, IndexedDB) across mediation handoffs. - Services MUST verify the RP ID hash matches the SHA-256 hash of the expected RP ID and verify the user presence (UP) and user verification (UV) flags according to the authentication policy. ## Bad vs Good Implementations ### Atomic Challenge Consumption and Origin Quarantine Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The challenge is read without atomic invalidation, creating a race window where an adversary-in-the-middle proxy can reuse the active challenge or race verification. Furthermore, computing expectedOrigin from request headers (x-forwarded-host) allows an attacker to bypass origin binding. ```typescript import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import type { AuthenticationResponseJSON } from '@simplewebauthn/types'; export async function verifyPasskeyAssertion( userId: string, response: AuthenticationResponseJSON ) { // Anti-pattern: Challenge is fetched but NOT atomically invalidated before verification. // An AiTM relay can replay the assertion or reuse the active challenge window. const session = await db.session.findUnique({ where: { userId } }); const expectedChallenge = session?.currentChallenge; if (!expectedChallenge) { throw new Error('No challenge found'); } // Anti-pattern: Permissive origin checking accepting forwarded host headers const origin = headers.get('x-forwarded-host') || 'localhost:3000'; const verification = await verifyAuthenticationResponse({ response, expectedChallenge, expectedOrigin: `https://${origin}`, expectedRPID: origin, }); if (verification.verified) { // Late invalidation: Leaves a vulnerability window for parallel relay requests await db.session.update({ where: { userId }, data: { currentChallenge: null }, }); } return verification; } ``` #### Production Standard (Correct) > **Standard**: Uses an atomic Redis GETDEL operation to guarantee single-use consumption of the challenge before verification begins, neutralizing replay and relay concurrency attacks. Validates the assertion against an immutable, canonical set of trusted origins rather than untrusted request headers. ```typescript import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import type { AuthenticationResponseJSON } from '@simplewebauthn/types'; import { redis } from '@/lib/redis'; import { ALLOWED_ORIGINS, EXPECTED_RP_ID } from '@/config/auth'; export async function verifyPasskeyAssertion( challengeToken: string, response: AuthenticationResponseJSON ) { // Invariant: Atomic single-use challenge consumption via Redis GETDEL const challengeKey = `webauthn:challenge:${challengeToken}`; const expectedChallenge = await redis.getdel(challengeKey); if (!expectedChallenge) { throw new Error('Challenge expired, previously consumed, or invalid'); } // Invariant: clientDataJSON origin must strictly match immutable canonical whitelist const verification = await verifyAuthenticationResponse({ response, expectedChallenge, expectedOrigin: ALLOWED_ORIGINS, expectedRPID: EXPECTED_RP_ID, requireUserVerification: true, }); if (!verification.verified || !verification.authenticationInfo) { throw new Error('WebAuthn assertion failed cryptographic verification'); } return verification.authenticationInfo; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn Conditional Mediation Origin Quarantine and Atomic Challenge Invalidation

WebAuthn Conditional Mediation Origin Quarantine and Atomic Challenge Invalidation defines an industrial-grade behavioral standard for security engineering. Enforces strict origin-bound assertion verification and atomic challenge invalidation across hybrid Passkey UI handoffs and conditional mediation lifecycles. Prevents adversary-in-the-middle (AiTM) reverse-proxy relay attacks by cryptographically binding ClientDataJSON origin and RP ID while enforcing single-use challenge consumption within a strict timeout quarantine window. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Reusable Challenges and Unverified ClientData Origins in Hybrid Conditional Passkey Mediations Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Reusable Challenges and Unverified ClientData Origins in Hybrid Conditional Passkey Mediations	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS atomically consume and invalidate authentication challenges in a single transaction (e.g., Redis GETDEL or atomic SQL DELETE ... RETURNING) immediately upon receipt before executing assertion parsing.

Engineers MUST ALWAYS atomically consume and invalidate authentication challenges in a single transaction (e.g., Redis GETDEL or atomic SQL DELETE ... RETURNING) immediately upon receipt before executing assertion parsing.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.