fix(auth): set WebAuthn user verification per request (#38805)

mirror of https://github.com/go-gitea/gitea.git synced 2026-08-09 08:02:27 +00:00

Registration omitted `userVerification`, so Chromium raised the
credential to credProtect level 3 and the authenticator then hid it from
the second-factor login, which asked for `discouraged`. Registration and
each login now set their own value, with `preferred` on the second
factor so credentials already registered at level 3 keep working without
re-enrollment.

Also add relevant e2e test coverage for webauthn, one test chromium only
because Firefox lacks the APIs needed.

Fixes https://github.com/go-gitea/gitea/issues/33531
Fixes https://github.com/go-gitea/gitea/issues/36019
Fixes https://github.com/go-gitea/gitea/issues/38139

This commit is contained in:

silverwind

2026-08-07 02:11:34 +02:00

committed by

GitHub

parent c210ef6dbb

commit 9dac77fdc2

16 changed files with 316 additions and 107 deletions

									
										services/auth/session.go
									
		+1
		
												View File
												
				@@ -64,4 +64,5 @@ func ClearSessionKeysForSignIn(sess SessionStore) {

					_ = sess.Delete("webauthnAssertion")

					_ = sess.Delete("linkAccount")

					_ = sess.Delete("linkAccountData")

					_ = sess.Delete("openidPendingURI")

				}