silverwind 9dac77fdc2 fix(auth): set WebAuthn user verification per request (#38805) ...

Registration omitted `userVerification`, so Chromium raised the
credential to credProtect level 3 and the authenticator then hid it from
the second-factor login, which asked for `discouraged`. Registration and
each login now set their own value, with `preferred` on the second
factor so credentials already registered at level 3 keep working without
re-enrollment.

Also add relevant e2e test coverage for webauthn, one test chromium only
because Firefox lacks the APIs needed.

Fixes https://github.com/go-gitea/gitea/issues/33531
Fixes https://github.com/go-gitea/gitea/issues/36019
Fixes https://github.com/go-gitea/gitea/issues/38139

2026-08-07 00:11:34 +00:00

..

2fa.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

auth_test.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

auth.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

linkaccount.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

main_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

oauth2_provider.go

chore: drop "oidc_wellknown" tmpl, use json directly (#38731)

2026-07-31 18:32:01 +02:00

oauth2_wellknown.go

chore: drop "oidc_wellknown" tmpl, use json directly (#38731)

2026-07-31 18:32:01 +02:00

oauth_signin_sync.go

fix(oauth2): not respecting claims before second login (#37874)

2026-06-03 16:50:47 +00:00

oauth_test.go

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

oauth.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

openid.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

password.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

webauthn.go

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00