teamhanko / hanko

Authentication and User Management solution for developers. Open source alternative to Clerk & Auth0.
https://hanko.io
Other
7.31k stars 933 forks source link

fix MFA login with security key #1968

Closed FreddyDevelop closed 2 weeks ago

FreddyDevelop commented 2 weeks ago

Description

The MFA login with security key due to wrongly used validation method of the webauthn library. The security key validation must not use the validation method for discoverable credentials, because the MFA credential is not created as a discoverable credential. Because of the usage of the wrong method a MFA login with a security key never succeeds.

Implementation

Use the correct webauthn validation method to validate the MFA security key response.

Tests

  1. Create a new user with a security key as MFA method
  2. Try to login with the security key