search

duo-labs / webauthn.io

The source code for webauthn.io, a demonstration of WebAuthn.
https://webauthn.io
BSD 3-Clause "New" or "Revised" License
645 stars 120 forks source link

Logging in with the username "test" results in an error #55

Closed nharper closed 1 year ago

nharper commented 2 years ago

Today, when trying to log in with a username of "test", I got the error "The allowCredentials attribute exceeds the maximum allowed size (64)". This error comes from Chrome's implementation (https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/modules/credentialmanagement/credentials_container.cc;l=929?q=allowCredentials%2064&ss=chromium).

It appears the cause of this is that "test" is a popular username, so many people have registered keys with that name. When performing a login, webauthn.io client code requests all registered IDs for the given username from the server, and puts all of them in allowCredentials.

One possible fix for this would be to limit how many keys can be registered for a given username.

MasterKale commented 1 year ago

Good catch, I didn't account for this in the revamp of the site (#58) so it's probably still an issue. Leaving this open for now.