sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-09-08 20:21:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce user verification for login assertions

Browse Source
This commit is contained in:
Elias Schneider
2026-07-26 19:08:34 +02:00
parent 9f559788a4
commit 4743d5967a
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
backend/internal/webauthn/service.go
View File

@@ -248,8 +248,10 @@ func (s *Service) VerifyLogin(ctx context.Context, dbConfig *appconfig.AppConfig
}
session := gowebauthn.SessionData{
Challenge: storedSession.Challenge,
Expires: storedSession.ExpiresAt.ToTime(),
Challenge: storedSession.Challenge,
Expires: storedSession.ExpiresAt.ToTime(),
UserVerification: protocol.UserVerificationRequirement(storedSession.UserVerification),
CredParams: storedSession.CredentialParams,
}
var user *model.User
@@ -450,8 +452,10 @@ func (s *Service) CreateReauthenticationTokenWithWebauthn(ctx context.Context, s
}
session := gowebauthn.SessionData{
Challenge: storedSession.Challenge,
Expires: storedSession.ExpiresAt.ToTime(),
Challenge: storedSession.Challenge,
Expires: storedSession.ExpiresAt.ToTime(),
UserVerification: protocol.UserVerificationRequirement(storedSession.UserVerification),
CredParams: storedSession.CredentialParams,
}
// Validate the credential assertion