dodobrands / WebAuthn.Net

WebAuthn (Passkeys) library for .NET.
MIT License
149 stars 2 forks source link

Attestation interruption causes authentication failure #7

Closed a-stankevich closed 4 months ago

a-stankevich commented 5 months ago

Steps to reproduce

  1. Go to https://webauthn.dodo.dev/usernameless or https://webauthn.dodo.dev/passwordless
  2. Enter Username and click "Register"
  3. In the system prompt (Touch Id / Face Id / Windows Hello / Security Key) click Cancel
  4. The page correctly says that registraton was interrupted
  5. Without changing Username click "Register" once again and complete registration process
  6. The page says "User registered!"
  7. Now click "Sign In"
  8. The page says {"":["User not found"]}

This is reproducible on iOS decives, Windows Hello and Yubikeys in Safari, Chrome, Firefox

This scenario also works correctly on passkeys.io and fido2-net-lib.passwordless.dev

vanbukin commented 4 months ago

Since the library has no knowledge of users (its entire understanding of users is limited to the UserHandle property of type byte[]), the problem most likely lies in the code of our demo application. We will investigate the root causes.