28.0.0 bumped `github.com/go-webauthn/webauthn` from v0.17.4 to
v0.18.x. v0.18.0 made the ceremony fail whenever the client returns a
client extension output the relying party did not request, unless
`Config.ExtensionsUnsolicitedOutputPolicy` says otherwise; the strict
behavior is the zero value, so not configuring a policy opts into it
(upstream MIGRATION.md §2.4).
Every security-key and passkey login from Safari on iOS fails with 403:
Client returned the "appid" extension output which was not requested
To fix, set `ExtensionsUnsolicitedOutputPolicy:
protocol.UnsolicitedOutputPolicyIgnore` in the webauthn config
Fixes#39790
---------
Signed-off-by: choksi2212 <choksi2212@users.noreply.github.com>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: choksi2212 <choksi2212@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This PR fixes two bugs with Webauthn support:
* There was a longstanding bug within webauthn due to the backend using
URLEncodedBase64 but the javascript using decoding using plain base64.
This causes intermittent issues with users reporting decoding errors.
* Following the recent upgrade to webauthn there was a change in the way
the library expects RPOrigins to be configured. This leads to the
Relying Party Origin not being configured and prevents registration.
Fix#22507
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Change all license headers to comply with REUSE specification.
Fix#16132
Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
