Verify topOrigin during credential registration and authentication

README.md

@@ -107,6 +107,9 @@ WebAuthn.configure do |config|
   # When operating within iframes or embedded contexts, you may need to restrict
   # which top-level origins are permitted to host WebAuthn ceremonies.
   #
+  # To enable this check, set the following configuration (disabled by default):
+  # config.verify_top_origin = false
+  #
   # Each entry in this list must match the `topOrigin` reported by the browser
   # during registration and authentication.
   #

lib/webauthn/authenticator_response.rb

@@ -131,7 +131,7 @@ def type
     end
 
     def needs_top_origin_verification?
-      client_data.cross_origin || client_data.top_origin
+      relying_party.verify_top_origin && (client_data.cross_origin || client_data.top_origin)
     end
   end
 end

lib/webauthn/configuration.rb

@@ -28,6 +28,8 @@ class Configuration
                    :allowed_top_origins=,
                    :verify_attestation_statement,
                    :verify_attestation_statement=,
+                   :verify_top_origin,
+                   :verify_top_origin=,
                    :credential_options_timeout,
                    :credential_options_timeout=,
                    :silent_authentication,

lib/webauthn/relying_party.rb

@@ -24,6 +24,7 @@ def initialize(
       id: nil,
       name: nil,
       verify_attestation_statement: true,
+      verify_top_origin: false,
       credential_options_timeout: 120000,
       silent_authentication: false,
       acceptable_attestation_types: ['None', 'Self', 'Basic', 'AttCA', 'Basic_or_AttCA', 'AnonCA'],
@@ -37,6 +38,7 @@ def initialize(
       @id = id
       @name = name
       @verify_attestation_statement = verify_attestation_statement
+      @verify_top_origin = verify_top_origin
       @credential_options_timeout = credential_options_timeout
       @silent_authentication = silent_authentication
       @acceptable_attestation_types = acceptable_attestation_types
@@ -52,6 +54,7 @@ def initialize(
                   :id,
                   :name,
                   :verify_attestation_statement,
+                  :verify_top_origin,
                   :credential_options_timeout,
                   :silent_authentication,
                   :acceptable_attestation_types,