Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-08 14:47:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): set WebAuthn user verification per request (#38805)

Browse Source 
Registration omitted `userVerification`, so Chromium raised the
credential to credProtect level 3 and the authenticator then hid it from
the second-factor login, which asked for `discouraged`. Registration and
each login now set their own value, with `preferred` on the second
factor so credentials already registered at level 3 keep working without
re-enrollment.

Also add relevant e2e test coverage for webauthn, one test chromium only
because Firefox lacks the APIs needed.

Fixes https://github.com/go-gitea/gitea/issues/33531
Fixes https://github.com/go-gitea/gitea/issues/36019
Fixes https://github.com/go-gitea/gitea/issues/38139
This commit is contained in:
silverwind
2026-08-07 02:11:34 +02:00
committed by GitHub
parent c210ef6dbb
commit 9dac77fdc2
16 changed files with 316 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/user/setting/security/webauthn.go
+10 -1
View File
@@ -53,8 +53,17 @@ func WebAuthnRegister(ctx *context.Context) {
}
webAuthnUser := wa.NewWebAuthnUser(ctx, ctx.Doer)
credentialOptions, sessionData, err := wa.WebAuthn.BeginRegistration(webAuthnUser, webauthn.WithAuthenticatorSelection(protocol.AuthenticatorSelection{
// the exclusions stop enrolling the same authenticator twice
credentials, err := auth.GetWebAuthnCredentialsByUID(ctx, ctx.Doer.ID)
if err != nil {
ctx.ServerError("GetWebAuthnCredentialsByUID", err)
return
}
exclusions := webauthn.Credentials(credentials.ToCredentials()).CredentialDescriptors()
credentialOptions, sessionData, err := wa.WebAuthn.BeginRegistration(webAuthnUser, webauthn.WithExclusions(exclusions), webauthn.WithAuthenticatorSelection(protocol.AuthenticatorSelection{
ResidentKey: protocol.ResidentKeyRequirementRequired,
// anything else makes Chromium raise it to credProtect level 3, hiding it from the second factor
UserVerification: protocol.VerificationRequired,
}))
if err != nil {
ctx.ServerError("Unable to BeginRegistration", err)