[java-idp-plugin-duo] branch dev/JDUO-80 updated: Surrender to the Javascript dark side.

Thu Jan 4 14:36:17 UTC 2024

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/JDUO-80
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=5918d2b057812f3c3efef2e7b83276dd5726862d

The following commit(s) were added to refs/heads/dev/JDUO-80 by this push:
     new 5918d2b0 Surrender to the Javascript dark side.
5918d2b0 is described below

commit 5918d2b057812f3c3efef2e7b83276dd5726862d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 4 09:36:14 2024 -0500

    Surrender to the Javascript dark side.
---
 .../idp/plugin/authn/duo/views/passwordless.vm     | 23 +++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
index 1c595b14..07ba6a28 100644
--- a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
+++ b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
@@ -23,6 +23,8 @@
 #if ($eventCtx)
 #set ($eventId = $eventCtx.getEvent())
 #end
+#set ($onClick = "document.password.j_username.value = document.passwordless.j_username.value")
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onClick)'")
 ##
 <!DOCTYPE html>
 <html>
@@ -65,20 +67,31 @@
                     <p>$encoder.encodeForHTML($desc)</p>
                 #end
 
-                <!-- Two forms are used below to allow the return key to trigger the Passwordless option after entering a name. -->
+                <!-- Two forms are used below to allow the return key to trigger the Passwordless option. -->
 
                 <blockquote>#springMessageText("idp.duo.passwordless.explain", "If you've enrolled a passkey or device/token for passwordless login,
                 please enter your username below and press the corresponding button. To bypass this option, just press the alternate button
                 to perform a traditional login.")</blockquote>
+
+                <form name="password" action="$flowExecutionUrl" method="post">
+                    #parse("csrf/csrf.vm")
+                    <input name="j_username" type="hidden" value="" />
+                    <div class="grid">
+                        <div class="grid-item">
+                            <button type="submit" name="_eventId_cancel" onClick="$onClick"
+                                >#springMessageText("idp.duo.passwordless.cancel", "Login with Password")</button>
+                        </div>
+                    </div>
+                </form>
                     
                 #if ($eventId == "RequestUnsupported")
                     <p class="output-message output--error">$encoder.encodeForHTML("#springMessageText('idp.duo.passwordless.unsupported', 'You have not enrolled a qualifying device for Passwordless use.')")</p>
                 #end
                         
-                <form action="$flowExecutionUrl" method="post">
+                <form name="passwordless" action="$flowExecutionUrl" method="post">
                     #parse("csrf/csrf.vm")
                     <label for="username">#springMessageText("idp.login.username", "Username")</label>
-                    <input id="username" name="j_username" type="text"
+                    <input name="j_username" type="text"
                         value="#if($username)$encoder.encodeForHTML($username)#end" />
                         
                     <input type="checkbox" name="donotcache" value="1" id="donotcache" />
@@ -92,10 +105,6 @@
                             <button type="submit" name="_eventId_proceed"
                                 >#springMessageText("idp.duo.passwordless.proceed", "Login with Passkey or Device")</button>
                         </div>
-                        <div class="grid-item">
-                            <button type="submit" name="_eventId_cancel"
-                                >#springMessageText("idp.duo.passwordless.cancel", "Login with Password")</button>
-                        </div>
                     </div>
                 </form>
     

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
