From 4743d5967a6b7e53d6d8c670c62f0bdea3abd4af Mon Sep 17 00:00:00 2001 From: Elias Schneider Date: Sun, 26 Jul 2026 19:08:34 +0200 Subject: [PATCH] fix: enforce user verification for login assertions --- backend/internal/webauthn/service.go | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/backend/internal/webauthn/service.go b/backend/internal/webauthn/service.go index 0e35dc8a..07a1e247 100644 --- a/backend/internal/webauthn/service.go +++ b/backend/internal/webauthn/service.go @@ -248,8 +248,10 @@ func (s *Service) VerifyLogin(ctx context.Context, dbConfig *appconfig.AppConfig } session := gowebauthn.SessionData{ - Challenge: storedSession.Challenge, - Expires: storedSession.ExpiresAt.ToTime(), + Challenge: storedSession.Challenge, + Expires: storedSession.ExpiresAt.ToTime(), + UserVerification: protocol.UserVerificationRequirement(storedSession.UserVerification), + CredParams: storedSession.CredentialParams, } var user *model.User @@ -450,8 +452,10 @@ func (s *Service) CreateReauthenticationTokenWithWebauthn(ctx context.Context, s } session := gowebauthn.SessionData{ - Challenge: storedSession.Challenge, - Expires: storedSession.ExpiresAt.ToTime(), + Challenge: storedSession.Challenge, + Expires: storedSession.ExpiresAt.ToTime(), + UserVerification: protocol.UserVerificationRequirement(storedSession.UserVerification), + CredParams: storedSession.CredentialParams, } // Validate the credential assertion