search

jazzband / django-two-factor-auth

Complete Two-Factor Authentication for Django providing the easiest integration into most Django projects.
MIT License
1.71k stars 448 forks source link

What is needed to upgrade to webauthn 2.0.0+? #701

Closed sergei-maertens closed 9 months ago

sergei-maertens commented 10 months ago

While investigating some conflicts in tooling in their Pydantic versions used, I noticed that webauthn 2.0.0 was released a couple weeks ago which dropped their dependency on Pydantic (which would solve my tooling issue). However, django-two-factor-auth pins webauthn on <1.99.

Does anyone have an idea what's needed to support webauthn 2.0.0 and could they provide some guidance? I can probably allocate some $dayjob time as it would make our setup/needs simpler to achieve.

Expected Behavior

Use django-two-factor-auth with webauthn 2.0.0

Current Behavior

Only v1 of webauthn is supported.

Possible Solution

See if/how the breaking changes affect the usage in django-two-factor-auth and if necessary:

The latter option should be safe for project that use Pydantic themselves, they will now only need to explicitly declare their dependency.

Steps to Reproduce (for bugs)

n/a

Context

I'm trying to use the bump-my-version tool and django-two-factor-auth[webauthn] in the same virtualenv, but they have incompatible pydantic requirements.

As a workaround, I can install/run bump-my-version from a different venv.

Your Environment

claudep commented 10 months ago

Hi Sergei, it would be nice if you could explore that and run tests with webauthn 2. I'm sure @jpaniagualaconich can help if you encounter serious issues.