Harden WebAuthn extension origins

webapp/public/webauthn-fallback-connector.html

@@ -170,6 +170,7 @@
       (function () {
         var params = new URLSearchParams(window.location.search);
         var sentSuccess = false;
+        var allowedParentOriginsPromise = null;
 
         var text = pickText(params.get("locale") || navigator.language || "en");
         document.documentElement.lang = params.get("locale") || navigator.language || "en";
@@ -227,24 +228,55 @@
           return out;
         }
 
-        function trustedParentOrigin() {
-          var parent = decodeRepeated(params.get("parent"));
-          if (!parent) return "";
+        function normalizeOrigin(value) {
+          if (!value) return "";
           try {
-            var parentUrl = new URL(parent);
-            if (
-              parentUrl.protocol === "chrome-extension:" ||
-              parentUrl.protocol === "moz-extension:" ||
-              parentUrl.protocol === "safari-web-extension:"
-            ) {
-              return parentUrl.protocol + "//" + parentUrl.host;
-            }
-            if (parentUrl.origin === window.location.origin) {
-              return parentUrl.origin;
-            }
+            var url = new URL(value);
+            if (!url.protocol || !url.host) return "";
+            return url.protocol + "//" + url.host;
           } catch (_error) {
             return "";
           }
+        }
+
+        function isExtensionOrigin(origin) {
+          return (
+            origin.indexOf("chrome-extension://") === 0 ||
+            origin.indexOf("moz-extension://") === 0 ||
+            origin.indexOf("safari-web-extension://") === 0
+          );
+        }
+
+        function allowedParentOrigins() {
+          if (allowedParentOriginsPromise) return allowedParentOriginsPromise;
+          allowedParentOriginsPromise = fetch("/api/web-bootstrap", {
+            headers: { Accept: "application/json" },
+            credentials: "omit",
+          }).then(function (response) {
+            if (!response.ok) return [];
+            return response.json();
+          }).then(function (body) {
+            var origins = Array.isArray(body && body.webAuthnAllowedOrigins)
+              ? body.webAuthnAllowedOrigins
+              : [];
+            return origins.map(normalizeOrigin).filter(Boolean);
+          }).catch(function () {
+            return [];
+          });
+          return allowedParentOriginsPromise;
+        }
+
+        function trustedParentOrigin(allowedOrigins) {
+          var parent = decodeRepeated(params.get("parent"));
+          if (!parent) return "";
+          var parentOrigin = normalizeOrigin(parent);
+          if (!parentOrigin) return "";
+          if (parentOrigin === window.location.origin) {
+            return parentOrigin;
+          }
+          if (isExtensionOrigin(parentOrigin) && allowedOrigins.indexOf(parentOrigin) >= 0) {
+            return parentOrigin;
+          }
           return "";
         }
 
@@ -258,8 +290,8 @@
           return copy;
         }
 
-        function postResult(message) {
-          var parentOrigin = trustedParentOrigin();
+        async function postResult(message) {
+          var parentOrigin = trustedParentOrigin(await allowedParentOrigins());
           if (parentOrigin) {
             if (window.opener && !window.opener.closed) {
               window.opener.postMessage(message, parentOrigin);
@@ -371,7 +403,7 @@
             if (!(credential instanceof PublicKeyCredential)) {
               throw new Error("No security key was selected.");
             }
-            postResult({
+            await postResult({
               command: "webAuthnResult",
               data: credentialToDataString(credential),
               remember: rememberEl.checked,