ChallengeValidator { public void validate(CollectedClientData collectedClientData, ServerProperty serverProperty) { AssertUtil.notNull(collectedClientData, "collectedClientData must not be null"); AssertUtil.notNull(serverProperty, "serverProperty must not be null"); Challenge savedChallenge = serverProperty.getChallenge(); Challenge collectedChallenge = collectedClientData.getChallenge(); if (savedChallenge == null) { throw new MissingChallengeException("The server doesn't have a challenge. The client must request the server to issue the challenge before WebAuthn operations."); } validate(savedChallenge, collectedChallenge); }  void validate(CollectedClientData collectedClientData, ServerProperty serverProperty); void validate(Challenge expected, Challenge actual);  }
@Test void verifyChallenge_test1() { Challenge challengeA = new DefaultChallenge(new byte[]{0x00}); Challenge challengeB = new DefaultChallenge(new byte[]{0x00}); CollectedClientData collectedClientData = new CollectedClientData(ClientDataType.CREATE, challengeA, null, null); ServerProperty serverProperty = new ServerProperty(origin, null, challengeB, null); target.validate(collectedClientData, serverProperty); }
@Test void verifyChallenge_test_with_different_challenge() { Challenge challengeA = new DefaultChallenge(new byte[]{0x00}); Challenge challengeB = new DefaultChallenge(new byte[]{0x01}); CollectedClientData collectedClientData = new CollectedClientData(ClientDataType.CREATE, challengeA, null, null); ServerProperty serverProperty = new ServerProperty(origin, null, challengeB, null); assertThrows(BadChallengeException.class, () -> target.validate(collectedClientData, serverProperty) ); }
@Test void verifyChallenge_test_without_saved_challenge() { Challenge challengeA = new DefaultChallenge(new byte[]{0x00}); Challenge challengeB = null; CollectedClientData collectedClientData = new CollectedClientData(ClientDataType.CREATE, challengeA, null, null); ServerProperty serverProperty = new ServerProperty(origin, null, challengeB, null); assertThrows(MissingChallengeException.class, () -> target.validate(collectedClientData, serverProperty) ); }