feat: add webauthn by justin-jiajia · Pull Request #895 · muety/wakapi

justin-jiajia · 2026-01-03T14:04:05Z

closes #613

muety · 2026-01-03T14:52:31Z

No idea how Copilot came up with the idea of reviewing this (should be disabled 🤔), but please ignore those comments. I'll give this a review as soon as possible. Thanks for your contribution.

justin-jiajia · 2026-01-03T15:16:34Z

No idea how Copilot came up with the idea of reviewing this (should be disabled 🤔), but please ignore those comments. I'll give this a review as soon as possible. Thanks for your contribution.

Well I've opened it on my side as I wondered how it worked :)

Don't be that hurry as I'm going to take a exam and maybe work on it again next weekend or later.

BTW: I'm aware that I forgot to use snake-case for attestation json somewhere, and I should brotil the webauthn library too. Will fix them next time I'm free.

justin-jiajia · 2026-01-10T14:13:06Z

BTW: I'm aware that I forgot to use snake-case for attestation json somewhere, and I should brotil the webauthn library too. Will fix them next time I'm free.

Done

muety

Thanks a lot for this PR! Sorry for taking so long with this review and sorry in advance for the number of comments I put. Please have a look at them anyway.

Also, could you please:

Add some basic tests for this, if possible? Perhaps do some research how to best tests stuff like this.
Add a config option to explicitly enable / disable WebAuthn login, just like you can disable OIDC.

repositories/webauthn.go

models/webauthn.go

services/user.go

routes/login.go

views/settings.tpl.html

models/webauthn.go

migrations/20260103_add_webauthn_fields.go

config/webauthn.go

repositories/webauthn.go

…redential storing problems, and update settings UI

justin-jiajia · 2026-01-24T14:10:13Z

Add some basic tests for this, if possible? Perhaps do some research how to best tests stuff like this.

Will do some research next time I'm free. A questions while browsing existing tests: how do you generate the mocks? Are they generated by a program (like mockery )? Or are they written by hand?

Add a config option to explicitly enable / disable WebAuthn login, just like you can disable OIDC.

Before implementing it, I want to know: should the users registered through OIDC be allowed to set up passkeys and log in with a passkey? (and why OIDC users should not be able to set a password for themselves, BTW)

justin-jiajia · 2026-01-30T10:11:48Z

Add some basic tests for this, if possible? Perhaps do some research how to best tests stuff like this.

Will do some research next time I'm free. A questions while browsing existing tests: how do you generate the mocks? Are they generated by a program (like mockery )? Or are they written by hand?

Should it be a unit test or an API test? And found a library descope/virtualwebauthn for virtual testing.

Add a config option to explicitly enable / disable WebAuthn login, just like you can disable OIDC.

Before implementing it, I want to know: should the users registered through OIDC be allowed to set up passkeys and log in with a passkey? (and why OIDC users should not be able to set a password for themselves, BTW)

Done. There's currently a security.disable_webauthn option. But OIDC users ARE allowed to register passkeys if the option is set to false (the default value). I'm not sure if you think this behavior is expected by you.

justin-jiajia · 2026-02-04T14:10:59Z

@muety Any updates? 👀

muety · 2026-02-06T11:41:06Z

Sorry, being super busy rn, will give this a review likely tomorrow!

muety

Thanks for implementing all those change requests!

A questions while browsing existing tests: how do you generate the mocks? Are they generated by a program (like mockery )? Or are they written by hand?

Written by hand.

should the users registered through OIDC be allowed to set up passkeys and log in with a passkey?

No, OIDC users will ever only log in via OIDC.

and why OIDC users should not be able to set a password for themselves, BTW

What would be the point of that? They would never get to enter it anywhere, because authentication is delegated to the OIDC provider and they'll come back logged in.

But OIDC users ARE allowed to register passkeys if the option is set to false (the default value).

When would an OIDC-registered user ever get to use their passkey? They might log in with their OIDC provider (e.g. GitLab) with a passkey they have registered with them, but once a user has OIDC enabled, Wakapi doesn't bother about authenticating the user at all.

Edit: Never mind the above comment. Technically, there's actually nothing against an OIDC user registering a passkey as well. But I'd still like to prevent this to have a clear separation between who is responsible for authentication – either the upstream provider or Wakapi itself. Would you disagree?

Should it be a unit test or an API test? And found a library descope/virtualwebauthn for virtual testing.

Whichever you think is more suitable. In general, there should be tests to check if a user can successfully log in using a passkey (if registered) as well as common error cases (e.g. authenticator signature is invalid / doesn't match the registered credentials). The library you referenced looks promising, feel free to pull it in as a dependency.

Sorry for this review process being so lengthy! 😐

static/assets/js/components/settings.js

…ings template

…ion in summary chart

justin-jiajia · 2026-02-12T11:52:05Z

Happened to find a bug related to the hourly breakdown. Fixed via e189a83. I also made a comment about the cause of the bug there.

Before	After

muety

Last set of change requests, I promise! 🙏 Big thank you for your patience and diligence!

static/assets/js/summary.js

static/assets/js/components/settings.js

routes/webauthn_test.go

muety · 2026-02-16T22:08:34Z

routes/webauthn_test.go

+	lastCookies     []*http.Cookie
+)
+
+func TestWebauthn_RegisterAndAuth(t *testing.T) {


While you're mostly testing the "happy path", please add some basic failure tests as well, including "Login should fail when an invalid signature is provided" and perhaps a few more "authenticator-related" error cases that come to your mind?

- Removed TotalUsers field from LoginViewModel as it was no longer needed and adjusted tests to remove dependencies on user count. - Enhanced WebAuthn session management by adding expiration handling. - Improved WebAuthn tests - Fixed fetch URL in settings.js for WebAuthn options.

justin-jiajia · 2026-02-19T11:45:54Z

First of all, happy Spring Festival! ❤️ from China.

I've added some tests that I can come up with. But some of the boilerplate test codes and the summary below are AI-generated. Let me know if you think that's not appropriate. I have also removed the TotalUserCount at the login page since it's not used in the html template.

TestWebauthn_RegisterDeniedForNonLocalUsers
Verifies that non-local users cannot register WebAuthn authenticators. Expects a 400 Bad Request and an error message.
TestWebauthn_RegisterAndLogin
Registers a WebAuthn authenticator for a user, then logs in with it. Checks that registration and login both succeed, and the authenticator’s name appears in the settings page.
TestWebauthn_RegisterMultipleAndLogin
Registers two authenticators for the same user. Verifies that both can be used to log in, and each login is successful.
TestWebauthn_DeleteAndLoginFailure
Registers and then deletes an authenticator. Attempts to log in with the deleted authenticator, expecting failure.
TestWebauthn_LoginFailureWithWrongAuthenticator
Registers authenticators for two users. Attempts various logins with mismatched authenticators and users, verifying that only the correct combinations succeed.
TestWebauthn_RegisterDuplicateAuthenticatorNameDenied
Attempts to register two authenticators with the same name for a user. Expects the second registration to fail with a 400 Bad Request and an error message.
TestWebauthn_LoginChallengeMismatchReplayProtection
Simulates a replay attack by submitting an assertion for an old challenge. Expects authentication to fail with a 401 Unauthorized and an error message. ('invalid signature' like you said)
TestWebauthn_LoginSuccessThenTimeoutThenFail
Logs in successfully, then forcibly expires the session, and attempts to log in again with the same assertion. Expects the second login to fail due to session expiry.

justin-jiajia · 2026-02-23T14:49:36Z

@muety It seemed that with webauthn disabled on wakapi.dev, user still get the UI to add a passkey. I figured out that there's an extra {{ end }} at /views/settings.tpl.html, line ~~206~~ 226. Please you remove that line. Really sorry for my carelessness 😢

Copilot AI review requested due to automatic review settings January 3, 2026 14:04

Copilot started reviewing on behalf of justin-jiajia January 3, 2026 14:04 View session

This comment was marked as spam.

Sign in to view

muety self-requested a review January 3, 2026 14:45

feat: add webauthn

32eab72

justin-jiajia force-pushed the master branch from 9172a5a to 32eab72 Compare January 10, 2026 14:12

muety requested changes Jan 19, 2026

View reviewed changes

justin-jiajia added 2 commits January 24, 2026 21:02

chore: minor code style

99c79a4

feat: move WebAuthn registration options into separate api, resolve C…

faf8848

…redential storing problems, and update settings UI

justin-jiajia requested a review from muety January 24, 2026 14:10

justin-jiajia added 3 commits January 29, 2026 21:43

Merge remote-tracking branch 'upstream/master'

29b945e

chore: resolve merge conflict

63aee85

feat: allow to disable webauthn

acf2218

chore: add WebAuthn service mock & fix WebAuthnCredential.ID

2168138

justin-jiajia force-pushed the master branch from 6c30821 to 2168138 Compare January 31, 2026 12:33

muety requested changes Feb 8, 2026

View reviewed changes

static/assets/js/components/settings.js Outdated Show resolved Hide resolved

justin-jiajia added 3 commits February 10, 2026 20:09

feat: restrict WebAuthn authentication to local users and update sett…

b054758

…ings template

fix: correct fetch URL for WebAuthn options and handle negative durat…

e189a83

…ion in summary chart

feat: implement WebAuthn testing

ee89bc2

minor: fix the WebAuthn testing

795f2d2

justin-jiajia requested a review from muety February 12, 2026 15:00

muety requested changes Feb 16, 2026

View reviewed changes

muety merged commit 566eae1 into muety:master Feb 22, 2026
2 checks passed

Uh oh!

Conversation

justin-jiajia commented Jan 3, 2026

Uh oh!

This comment was marked as spam.

Uh oh!

muety commented Jan 3, 2026

Uh oh!

justin-jiajia commented Jan 3, 2026

Uh oh!

justin-jiajia commented Jan 10, 2026

Uh oh!

muety left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justin-jiajia commented Jan 24, 2026

Uh oh!

justin-jiajia commented Jan 30, 2026

Uh oh!

justin-jiajia commented Feb 4, 2026

Uh oh!

muety commented Feb 6, 2026

Uh oh!

muety left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

justin-jiajia commented Feb 12, 2026

Uh oh!

muety left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

muety Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

justin-jiajia commented Feb 19, 2026

Uh oh!

Uh oh!

justin-jiajia commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

muety left a comment •

edited

Loading

justin-jiajia commented Feb 23, 2026 •

edited

Loading