Marc-André Bombeck 2c1151dd40 fix(auth): guard the webauthn login challenge kind and require user verification ...

Mirror the TOTP login path: both the security-key verify and verify-options
routes now reject any challenge whose kind is not "login" with the same generic
401, so a future step-up or non-login challenge can never mint a login session
through these endpoints. Set the registration and authentication ceremonies to
userVerification:"required" to match the server's UV enforcement — a key that
passes the browser but skips UV would otherwise fail server-side.

2026-06-27 22:22:46 +02:00

..

verify

feat(auth): allow trusting a device to skip the second factor

2026-06-27 21:49:39 +02:00

webauthn/verify

fix(auth): guard the webauthn login challenge kind and require user verification

2026-06-27 22:22:46 +02:00