Repo Example Fails at User Verification

[jneander]

I'm trying to run the example included in the repo, but am encountering an issue at registration. This step fails with the following error message, both in Chrome and Safari on macOS. I'm still learning about passkeys, so it's very possible I'm doing something wrong.

Oh no, something went wrong! Response:
{"error":"User verification required, but user could not be verified"}

[spendres]

Did you start the backend server too?

…

On Wed, Jul 19, 2023 at 11:49 AM Jeremy Neander ***@***.***> wrote: I'm trying to run the example included in the repo, but am encountering an issue at registration. This step fails with the following error message, both in Chrome and Safari on macOS. I'm still learning about passkeys, so it's very possible I'm doing something wrong. Oh no, something went wrong! Response: {"error":"User verification required, but user could not be verified"} [image: Screenshot 2023-07-19 at 10 46 50 AM] <https://user-images.githubusercontent.com/880186/254629792-1c4615e6-d08e-4e31-9964-de3660e4d1ef.png> — Reply to this email directly, view it on GitHub <#416>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEVLYHRIUDLZIF7S7VFESLXQ76XXANCNFSM6AAAAAA2QEFYJA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[jneander]

I'm running the Express server in the example folder. https://github.com/MasterKale/SimpleWebAuthn/blob/master/example/package.json

[spendres]

Do you see any errors in the chrome developer console after you reload the webpage?

…

On Wed, Jul 19, 2023 at 11:58 AM Jeremy Neander ***@***.***> wrote: I'm running the Express server in the example folder. https://github.com/MasterKale/SimpleWebAuthn/blob/master/example/package.json — Reply to this email directly, view it on GitHub <#416 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEVLYB6WSC3HQBGI4S7BKTXQ77Z7ANCNFSM6AAAAAA2QEFYJA> . You are receiving this because you commented.Message ID: ***@***.*** com>

[jneander]

There is nothing upon page load. As soon as I click "Register," this error appears:

When I attempt to complete the "create passkey" flow, this error appears:

[MasterKale]

That first error is expected, it's the Conditional UI request being cancelled because only a single WebAuthn call can be "in-flight" at a time.

The second HTTP 400 error is the error that returns in your screenshot in the OP.

[MasterKale]

Hello @jneander, can you please include the JSON return value from the call to /generate-registration-options, and the JSON WebAuthn response that gets POST'd to /verify-registration?

It would also help to know what authenticator you're attempting to use, as well as versions of your OS, Chrome, and Safari browsers.

LASTLY, I'll ask if you're on an MBP, and if you are if it's in clamshell mode; alternatively I'm also curious if you're on a Mac Mini, if you're not using an MBP.

[jneander]

The response from /generate-registration-options:

{
    "challenge": "VPspjTRVC4dk_XYnqRhBBuwrX4kP22YTGdYD9GdsWXQ",
    "rp": {
        "name": "SimpleWebAuthn Example",
        "id": "localhost"
    },
    "user": {
        "id": "internalUserId",
        "name": "user@localhost",
        "displayName": "user@localhost"
    },
    "pubKeyCredParams": [
        {
            "alg": -7,
            "type": "public-key"
        },
        {
            "alg": -257,
            "type": "public-key"
        }
    ],
    "timeout": 60000,
    "attestation": "none",
    "excludeCredentials": [],
    "authenticatorSelection": {
        "residentKey": "discouraged",
        "requireResidentKey": false
    },
    "extensions": {
        "credProps": true
    }
}

The data sent to /verify-registration:

{
  id: '1SFVij4bRdp8bQUuz4sZ4j7MJWHc6sD4CV6MtBumaHM',
  rawId: '1SFVij4bRdp8bQUuz4sZ4j7MJWHc6sD4CV6MtBumaHM',
  response: {
    attestationObject: 'o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVikSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NBAAAAAK3OAAI1vMYKZIsLJfHwVQMAINUhVYo-G0XafG0FLs-LGeI-zCVh3OrA-AlejLQbpmhzpQECAyYgASFYIBRD9sY65VdYiH5Hcu4ZK_SDCkgiVUFyCVg1Zi8N5CDjIlgg_e_1GMZTSFoDgSN0Tj_P3U-FG44n7oyTWK903MOpW5w',
    clientDataJSON: 'eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiVlBzcGpUUlZDNGRrX1hZbnFSaEJCdXdyWDRrUDIyWVRHZFlEOUdkc1dYUSIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMSIsImNyb3NzT3JpZ2luIjpmYWxzZX0',
    transports: [ 'internal' ]
  },
  type: 'public-key',
  clientExtensionResults: { credProps: { rk: true } },
  authenticatorAttachment: 'platform'
}

I am on the latest generation of MacBook Pro. It's running in clamshell mode.

• macOS Ventura 13.4.1
• Chrome 114.0.5735.198
• Safari Version 16.5.1 (18615.2.9.11.7)

[MasterKale]

I'm pretty sure what's going on is that userVerification is defaulting to "preferred" because it's not set to "required" in the registration options. See here:

https://www.w3.org/TR/webauthn-2/#dictionary-authenticatorSelection

For devices that don't have biometric sensors available, when user verification is "preferred" then browsers/the OS will skip the system password prompt and simply return a response without performing user verification. The uv flag in the WebAuthn response will be set to false accordingly. The error you're seeing is you getting back uv:false because you're in clamshell mode, but verifyRegistrationResponse() in the example app requires UV so it expects to see uv:true.

As for why "preferred" is treated like this, it's to handle the scenario of a user onboarding onto passkeys-based account authentication and then immediately being prompted for "a password" (the local login password) because a biometric sensor is unavailable. This is while we're all out here telling everyone that passkeys are "passwordless". It's incongruous and can lead to confusion, so Apple and Google in particular prefer to skip trying to perform user verification when biometrics are unavailable.

To fix this, you can either require user verification in the options you pass to generateRegistrationOptions()...

const opts: GenerateRegistrationOptionsOpts = {
  // ...
  authenticatorSelection: {
    // ...
    userVerification: 'required'
  },
  // ...
};

...or don't require user verification when you call verifyRegistrationResponse():

const opts: VerifyRegistrationResponseOpts = {
  // ...
  requireUserVerification: false,
};

As for whether you want to do this or not in your own site, that'll come down to your security modeling - there's no one-size-fits-all answer here. I'd highly recommend this section of passkeys.dev for more context that'll help you make a decision:

https://passkeys.dev/docs/use-cases/bootstrapping/#a-note-about-user-verification

[jneander]

That is a perfect answer! Thank you so much for all of that information. It's incredibly helpful.

[spendres]

Are you using an external keyboard with finger print reader to authenticate to your mac while in clamshell mode?

…

On Wed, Jul 19, 2023 at 12:43 PM Jeremy Neander ***@***.***> wrote: The response from /generate-registration-options: { "challenge": "VPspjTRVC4dk_XYnqRhBBuwrX4kP22YTGdYD9GdsWXQ", "rp": { "name": "SimpleWebAuthn Example", "id": "localhost" }, "user": { "id": "internalUserId", "name": ***@***.***", "displayName": ***@***.***" }, "pubKeyCredParams": [ { "alg": -7, "type": "public-key" }, { "alg": -257, "type": "public-key" } ], "timeout": 60000, "attestation": "none", "excludeCredentials": [], "authenticatorSelection": { "residentKey": "discouraged", "requireResidentKey": false }, "extensions": { "credProps": true } } The data sent to /verify-registration: { id: '1SFVij4bRdp8bQUuz4sZ4j7MJWHc6sD4CV6MtBumaHM', rawId: '1SFVij4bRdp8bQUuz4sZ4j7MJWHc6sD4CV6MtBumaHM', response: { attestationObject: 'o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVikSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NBAAAAAK3OAAI1vMYKZIsLJfHwVQMAINUhVYo-G0XafG0FLs-LGeI-zCVh3OrA-AlejLQbpmhzpQECAyYgASFYIBRD9sY65VdYiH5Hcu4ZK_SDCkgiVUFyCVg1Zi8N5CDjIlgg_e_1GMZTSFoDgSN0Tj_P3U-FG44n7oyTWK903MOpW5w', clientDataJSON: 'eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiVlBzcGpUUlZDNGRrX1hZbnFSaEJCdXdyWDRrUDIyWVRHZFlEOUdkc1dYUSIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMSIsImNyb3NzT3JpZ2luIjpmYWxzZX0', transports: [ 'internal' ] }, type: 'public-key', clientExtensionResults: { credProps: { rk: true } }, authenticatorAttachment: 'platform' } I am on the latest generation of MacBook Pro. It's running in clamshell mode. - macOS Ventura 13.4.1 - Chrome 114.0.5735.198 - Safari Version 16.5.1 (18615.2.9.11.7) — Reply to this email directly, view it on GitHub <#416 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEVLYDKPI77CUISN7Q44GTXRAFBXANCNFSM6AAAAAA2QEFYJA> . You are receiving this because you commented.Message ID: ***@***.*** com>

[jneander]

I am not. I use the system password when prompted.