Repository navigation
Conversation
aarmam
force-pushed
the
NFC-183
branch
2 times, most recently
from
September 22, 2026 11:23
1fcb89a to
ac40908
Compare
…ation Add a short section to the README that lists only what an application with a working regular Web eID integration has to change or add for the mobile authentication flow, naming the example files that implement each step. Digital signing is noted as not covered by the PHP library or example. Signed-off-by: Mart Aarma <mart.aarma@nortal.com> Co-authored-by: Sander Kondratjev <sander.kondratjev@nortal.com>
Signed-off-by: Mart Aarma <mart.aarma@nortal.com> Co-authored-by: Sander Kondratjev <sander.kondratjev@nortal.com>
Signed-off-by: Mart Aarma <mart.aarma@nortal.com> Co-authored-by: Sander Kondratjev <sander.kondratjev@nortal.com>
mrts
requested changes
Oct 5, 2026
| if (!isset($_SESSION["csrf-token"])) { | ||
| $_SESSION["csrf-token"] = bin2hex(random_bytes(32)); | ||
| } | ||
| $this->ctx->assertCsrf(); |
Member
There was a problem hiding this comment.
README MobileAuth code example still contains the old if (!isset($_SESSION[ ... snippet, the example code should be updated as well.
| ### Issuing challenge nonces for Web eID for Mobile | ||
|
|
||
| The `POST /auth/mobile/init` endpoint initiates authentication flows that use **Web eID token format v1.1**. It generates a challenge nonce and returns a deep link URI that embeds a base64-encoded payload containing the challenge nonce, the login endpoint URL and whether the mobile application should include the signing certificate information in the authentication token. The mobile application opens the deep link, signs the challenge and posts the `web-eid:1.1` authentication token to the `POST /auth/mobile/login` endpoint, which validates it with the same `AuthContext::authenticate()` method that is used in the regular flow. See the full implementation in `example/src/MobileAuth.php`. | ||
| The `POST /auth/mobile/init` endpoint initiates mobile authentication. Authentication-only responses use `web-eid:1.0`; requesting signing certificate information uses `web-eid:1.1`. It generates a challenge nonce and returns a deep link URI that embeds a base64-encoded payload containing the challenge nonce, the login endpoint URL and whether the mobile application should include the signing certificate information in the authentication token. The mobile application opens the deep link and returns the authentication token in the browser login page URL fragment. The page posts the token to `POST /auth/mobile/login`, which validates it with the same `AuthContext::authenticate()` method that is used in the regular flow. See the full implementation in `example/src/MobileAuth.php`. |
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signed-off-by: Mart Aarma mart.aarma@nortal.com