Marc-André Bombeck bf63f6bdba fix(auth): claim a WebAuthn challenge in the statement that checks it ...

The passkey sign-in, security-key sign-in and security-key registration
verifiers read the challenge, verified the response, and deleted the
challenge afterwards. Two requests carrying the same assertion could both
read it before either deleted it, and both be accepted.

A challenge is now claimed with one guarded DELETE ... RETURNING that also
checks its ceremony, its account and its expiry, before anything is
verified; a concurrent second request finds nothing. A passkey sign-in also
refuses a challenge that was begun for a different account than the passkey
belongs to.

2026-09-26 20:22:12 +02:00

..

__tests__

fix(auth): count a second-factor attempt before verifying it

2026-09-26 15:21:42 +02:00

challenge.ts

fix(auth): count a second-factor attempt before verifying it

2026-09-26 15:21:42 +02:00

recovery-codes.ts

fix(auth): harden the second-factor verify and disable surfaces

2026-06-27 20:08:10 +02:00

totp.ts

feat(auth): add TOTP second factor and recovery codes

2026-06-27 19:56:16 +02:00

verify-factor.ts

fix(auth): accept a TOTP code only from a confirmed secret

2026-09-26 15:19:26 +02:00

webauthn.ts

fix(auth): claim a WebAuthn challenge in the statement that checks it

2026-09-26 20:22:12 +02:00