search

kanidm / webauthn-rs

An implementation of webauthn components for Rustlang servers
Mozilla Public License 2.0
485 stars 80 forks source link

webauthn-rs demo URL-encodes user names / display names #318

Closed micolous closed 1 year ago

micolous commented 1 year ago

I did this

On a browser using Windows, macOS or iOS WebAuthn API:

  1. visit https://webauthn.firstyear.id.au/
  2. enter username: hello world
  3. press Begin Registration

I expected the following

OS prompts to set up Touch ID / Windows Hello for the user hello world.

What actually happened

OS prompts to set up Touch ID / Windows Hello for the user hello%20world:

image

Version (and git commit)

Operating System / Version

Any other comments

Any user name which contains characters other than [A-Za-z0-9] triggers the issue. The trivial example is a name with spaces in it, but is also an issue for names with any non-basic-Latin characters.

https://webauthn.io appears to work correctly:

image