The passkey registration process either timed out, was cancelled or is not allowed

agr · March 7, 2026, 11:51am

Ok, i got it fixed upstreams. The fixed registration and authentication and took it only on meta.discourse.com

github.com/discourse/discourse

FIX: passkey registration failing when extension data included

main ← fix-hardware-passkeys

opened 10:41PM - 04 Mar 26 UTC

keegangeorge

+32 -8

**Currently, passkey registration has two bugs:** 1. Registration fails with …an HTTP 500 for authenticators that include extension data (i.e. `hmac-secret` in their attestation response) because we slice all bytes after the credential ID the public key. 2. Registration fails with `NotAllowedError` on some hardware keys (i.e. Solo 2) because `pubKeyCredParams` includes invalid HMAC symmetric algorithms from the `COSE` gem, which strict authenticator firmware rejects. **This fix:** 1. Uses `CBOR::Unpacker` streaming decode to read exactly one `CBOR` object from the byte stream, stopping before any trailing extension data. Also adds `COSE::MalformedKeyError` to the rescue block so future failures return a proper error response. 2. Replaces the blanket `COSE::Algorithm.registered_algorithm_ids` with an explicit list of asymmetric signature algorithms valid for `WebAuthn`. Meta bug report: https://meta.discourse.org/t/cant-set-up-passkey-on-any-discourse/397642/

is there any way to tag somebody who can update the forum?