janko / rodauth-rails

Rails integration for Rodauth authentication framework
https://github.com/jeremyevans/rodauth
MIT License
565 stars 40 forks source link

WebAuthN setup route - Javascript doesn't load correctly on Rails 7 #168

Closed wtfiwtz closed 1 year ago

wtfiwtz commented 1 year ago

I'm on Rails 7.0.4 and there seems to be an extra parameter needed in the template:

<%= javascript_include_tag rodauth.webauthn_setup_js_path, extname: false %>

You need to set extname: false or it appends .js to the end of the JavaScript path, which won't match the one in bin/rails rodauth:routes. You see a HTTP 404.

As a result, it passes through the email address as text, not JSON, and this part in rodauth/features/webauthn.rb fails:

def webauthn_auth_credential_from_form_submission
      case auth_data = raw_param(webauthn_auth_param)
      when String
        begin
          auth_data = JSON.parse(auth_data)
        rescue
          throw_error_reason(:invalid_webauthn_auth_param, invalid_field_error_status, webauthn_auth_param, webauthn_invalid_auth_param_message) 
        end

The result is a 422 Unprocessable Entity exception on the submission of the form.

image

Cheers, Nigel (@wtfiwtz)