keegan
05.Март.2026 17:53:35
18
Спасибо @agr за выявление этой проблемы, я исправил её здесь:
main ← fix-hardware-passkeys
merged 05:51PM - 05 Mar 26 UTC
**Currently, passkey registration has two bugs:**
1. Registration fails with … an HTTP 500 for authenticators that include extension data (i.e. `hmac-secret` in their attestation response) because we slice all bytes after the credential ID the public key.
2. Registration fails with `NotAllowedError` on some hardware keys (i.e. Solo 2) because `pubKeyCredParams` includes invalid HMAC symmetric algorithms from the `COSE` gem, which strict authenticator firmware rejects.
**This fix:**
1. Uses `CBOR::Unpacker` streaming decode to read exactly one `CBOR` object from the byte stream, stopping before any trailing extension data. Also adds `COSE::MalformedKeyError` to the rescue block so future failures return a proper error response.
2. Replaces the blanket `COSE::Algorithm.registered_algorithm_ids` with an explicit list of asymmetric signature algorithms valid for `WebAuthn`.
Meta bug report: https://meta.discourse.org/t/cant-set-up-passkey-on-any-discourse/397642/
Обновление вашего Discourse до последней версии должно решить проблему, но если вы всё ещё столкнётесь с какими-либо трудностями, пожалуйста, сообщите нам об этом.
2 лайка