yrccondor / wp-webauthn

🔒 WP-WebAuthn allows you to safely login to your WordPress site without password.
https://wordpress.org/plugins/wp-webauthn
GNU General Public License v3.0
130 stars 15 forks source link

Login fail #55

Closed Vizeard closed 1 year ago

Vizeard commented 1 year ago

[2023-06-14 08:31:14][7a5246] PHP Version => 7.4.30, WordPress Version => 6.2.2, WP-WebAuthn Version => 1.2.8 [2023-06-14 08:31:14][7a5246] Current config: first_choice => "true", website_name => "FIDO2pub", website_domain => "dev-fido2testing.pantheonsite.io", remember_me => "false", user_verification => "false", allow_authenticator_type => "none", usernameless_login => "false" [2023-06-14 08:31:14][7a5246] Logger initialized [2023-06-14 08:31:20][f1817c] ajax_auth: Start [2023-06-14 08:31:20][f1817c] ajax_auth: type => "auth", user => "vizeard0324@gmail.com" [2023-06-14 08:31:20][f1817c] ajax_auth: User not exists, create a fake id [2023-06-14 08:31:20][f1817c] ajax_auth: allowedCredentials => [] [2023-06-14 08:31:20][f1817c] ajax_auth: user_verification => "false" [2023-06-14 08:31:20][f1817c] ajax_auth: Challenge sent [2023-06-14 08:31:25][f3751d] ajax_auth_response: Client response received [2023-06-14 08:31:25][f3751d] ajax_auth_response: type => "auth", user => "vizeard0324@gmail.com" [2023-06-14 08:31:25][f3751d] ajax_auth_response: data => {"id":"GOlDfBHUIZrfNVz7azNPgdYikTiI2n3_So3DCCwaxuexSGnntwzLtuLsoHQIhEmWd0bYRpLKEyMN1ZnHurr5nA","type":"public-key","rawId":"GOlDfBHUIZrfNVz7azNPgdYikTiI2n3/So3DCCwaxuexSGnntwzLtuLsoHQIhEmWd0bYRpLKEyMN1ZnHurr5nA==","response":{"authenticatorData":"1KhIAeSvzmN1mAM379I/36qR60cZpSx5UuOgkGcv7A8FAAAABg==","clientDataJSON":"eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiN0dIOWZXUnd1QWc2LTlwTkYyVWQzYUJtSmNQd3VfUmlJckRfeHotVHZSSSIsIm9yaWdpbiI6Imh0dHBzOi8vZGV2LWZpZG8ydGVzdGluZy5wYW50aGVvbnNpdGUuaW8iLCJjcm9zc09yaWdpbiI6ZmFsc2UsIm90aGVyX2tleXNfY2FuX2JlX2FkZGVkX2hlcmUiOiJkbyBub3QgY29tcGFyZSBjbGllbnREYXRhSlNPTiBhZ2FpbnN0IGEgdGVtcGxhdGUuIFNlZSBodHRwczovL2dvby5nbC95YWJQZXgifQ==","signature":"MEQCICVelH26mdNFZDiK7KYkHd2YrnSBr+MPT+GlHVhguzzWAiAOzPei67Cvl+m2u+G28NPcfKsoVR9Gl65Mln4JVv3y7g==","userHandle":"MTYyOGUzOGVhYzkyZWEyYjdjM2IxM2UyYTMyYzhlNGIyYzYwYTJjMDNjMGZlYWNkZDMzOGJlNjI1MTU4ZjNkZQ=="}} [2023-06-14 08:31:25][f3751d] ajax_auth_response: (ERROR)Invalid user handle [2023-06-14 08:31:25][f3751d] Traceback: 1) /code/wp-admin/admin-ajax.php(203): do_action('wp_ajaxnopriv...') 2) /code/wp-includes/plugin.php(517): WP_Hook->do_action(Array) 3) /code/wp-includes/class-wp-hook.php(332): WP_Hook->apply_filters('', Array) 4) /code/wp-includes/class-wp-hook.php(308): wwa_ajax_auth('') 5) /code/wp-content/plugins/wp-webauthn/wwa-ajax.php(981): Webauthn\Server->loadAndCheckAssertionResponse('{"id":"GOlDfBHU...', Object(Webauthn\PublicKeyCredentialRequestOptions), Object(Webauthn\PublicKeyCredentialUserEntity), Object(Nyholm\Psr7\ServerRequest)) 6) /code/wp-content/plugins/wp-webauthn/vendor/web-auth/webauthn-lib/src/Server.php(301): Webauthn\AuthenticatorAssertionResponseValidator->check('\x18\xE9C|\x11\xD4!\x9A\xDF5\\xFBk3O...', Object(Webauthn\AuthenticatorAssertionResponse), Object(Webauthn\PublicKeyCredentialRequestOptions), Object(Nyholm\Psr7\ServerRequest), '8fa2b3855825aa9...', Array) 7) /code/wp-content/plugins/wp-webauthn/vendor/web-auth/webauthn-lib/src/AuthenticatorAssertionResponseValidator.php(122): Assert\Assertion::eq('1628e38eac92ea2...', '8fa2b3855825aa9...', 'Invalid user ha...') [2023-06-14 08:31:25][f3751d] ajax_auth_response: (ERROR)Challenge not verified, exit

I have successfully register a key in my profile and it works under the "verify authenticator option" but when it comes to actual login, it has error

yrccondor commented 1 year ago

Hi Vizeard sorry for the late response I've been busy lately. I checked the code and I found that email login support is missing - the plugin just cannot find the right user by email. I'll fix this as fast as possible. Really sorry about that