Laragear / WebAuthn

Authenticate users with Passkeys: fingerprints, patterns and biometric data.
MIT License
305 stars 37 forks source link

E-Mail not really required for login #49

Closed ssgnoe closed 8 months ago

ssgnoe commented 1 year ago

PHP & Platform

8.1

Database

No response

Laravel version

10

Have you done this?

Expectation

When I'm logging in with wrong E-Mail Adress, the browser should not be able to find a matching Key.

Description

The browser is not able to find a matching key, but if I only have one key, the browser is choosing the one and logging in into the account where the key is for and not the account I typed the email-adress in.

So long story short: No matter which E-Mail I'm inserting in Login Form, I am always in the same account. Tested on MacOS with Chrome.

Potentially a bug in chrome? I'm not shure? Or is this the expected behaviour?

Reproduction

Generate Webauthn Login and try to log in with different E-Mail.

Stack trace & logs

No response

lorenzoaiello commented 11 months ago

Are you using userless() when registering a passkey?