fix: use challenge parameter in verifyJwtWebCrypto preimage

- Remove unused client data hashing in verifyJwtWebCrypto
- Use challenge parameter directly in preimage construction
- Fix TS6133 error for unused challenge parameter
- Make verification logic consistent with verifyJwtP256

This change maintains the same verification logic while properly
utilizing the challenge parameter in the signature verification.
This commit is contained in:
Matthew Raymer
2025-05-28 10:28:57 +00:00
parent 81ef55b2bf
commit 2d548bce1c

View File

@@ -398,11 +398,12 @@ export async function verifyJwtWebCrypto(
const sigBuffer = Buffer.from(signature, "base64"); const sigBuffer = Buffer.from(signature, "base64");
const finalSigBuffer = unwrapEC2Signature(sigBuffer); const finalSigBuffer = unwrapEC2Signature(sigBuffer);
// Hash the client data // Use challenge in preimage construction
const hash = sha256(clientDataFromBase); const preimage = Buffer.concat([
authDataFromBase,
Buffer.from(challenge),
]);
// Construct the preimage
const preimage = Buffer.concat([authDataFromBase, hash]);
return verifyPeerSignature(preimage, issuerDid, finalSigBuffer); return verifyPeerSignature(preimage, issuerDid, finalSigBuffer);
} }