keegan
Mars 5, 2026, 5:53
18
Merci @agr d’avoir identifié ce problème, j’ai publié un correctif ici :
main ← fix-hardware-passkeys
approved 05:50PM - 05 Mar 26 UTC
**Currently, passkey registration has two bugs:**
1. Registration fails with … an HTTP 500 for authenticators that include extension data (i.e. `hmac-secret` in their attestation response) because we slice all bytes after the credential ID the public key.
2. Registration fails with `NotAllowedError` on some hardware keys (i.e. Solo 2) because `pubKeyCredParams` includes invalid HMAC symmetric algorithms from the `COSE` gem, which strict authenticator firmware rejects.
**This fix:**
1. Uses `CBOR::Unpacker` streaming decode to read exactly one `CBOR` object from the byte stream, stopping before any trailing extension data. Also adds `COSE::MalformedKeyError` to the rescue block so future failures return a proper error response.
2. Replaces the blanket `COSE::Algorithm.registered_algorithm_ids` with an explicit list of asymmetric signature algorithms valid for `WebAuthn`.
Meta bug report: https://meta.discourse.org/t/cant-set-up-passkey-on-any-discourse/397642/
La mise à jour de votre Discourse vers la dernière version devrait maintenant résoudre le problème, mais si vous rencontrez toujours des difficultés, veuillez nous en informer.
2 « J'aime »