Livio Spring 1d409f7959 fix(webauthn): allow to use "old" passkeys/u2f credentials on session API (#10150) ...

# Which Problems Are Solved

To prevent presenting unusable WebAuthN credentials to the user /
browser, we filtered out all credentials, which do not match the
requested RP ID. Since credentials set up through Login V1 and Console
do not have an RP ID stored, they never matched. This was previously
intended, since the Login V2 could be served on a separate domain.
The problem is, that if it is hosted on the same domain, the credentials
would also be filtered out and user would not be able to login.

# How the Problems Are Solved

Change the filtering to return credentials, if no RP ID is stored and
the requested RP ID matches the instance domain.

# Additional Changes

None

# Additional Context

Noted internally when testing the login v2

(cherry picked from commit 71575e8d67)

2025-07-11 08:01:06 +02:00

..

client.go

fix: add domain as attribute to list user auth methods (#8718)

2024-10-10 16:50:53 +00:00

converter_test.go

fix(webauthn): allow to use "old" passkeys/u2f credentials on session API (#10150)

2025-07-11 08:01:06 +02:00

converter.go

fix(webauthn): allow to use "old" passkeys/u2f credentials on session API (#10150)

2025-07-11 08:01:06 +02:00

webauthn_test.go

feat: trusted (instance) domains (#8369)

2024-07-31 18:00:38 +03:00

webauthn.go

fix(webauthn): allow to use "old" passkeys/u2f credentials on session API (#10150)

2025-07-11 08:01:06 +02:00