search

logto-io / logto

🧑‍🚀 The better identity infrastructure for developers and the open-source alternative to Auth0.
https://logto.io
Mozilla Public License 2.0
7.77k stars 381 forks source link

bug: failed to MFA login with a hardware pssskey or backup code #6107

Open lingkaix opened 1 week ago

lingkaix commented 1 week ago

Hi,

After registering MFA with a Yubikey, I always get 400 (with body: {"message":"WebAuthn verification failed.","code":"session.mfa.webauthn_verification_failed"} ) response when I login and verify MFA with the hardware key.

I'm using OSS v1.17.0 with the official container image. I can reproduce it on different Mac devices (iMac and MacBook), with multi browsers (Chrome and Firefox) and multi hardware keys( a Yubikey 5 NFC and a Yubikey 5c NFC), and within different apps (demo-app, admin console, and an app create by my own). So I think it is a common issue. Please check it.

Thanks!

lingkaix commented 1 week ago

Btw, OTP app works well within my OSS deployment.

darcyYe commented 1 week ago

@wangsijie would you like to take a look?

wangsijie commented 5 days ago

After discussion, the only problem is on the hardware.