Verify passkey algorithms from COSE keys

2026-09-04 12:19:15 -04:00
parent 3fe1547a5b
commit b1710e08b8
8 changed files with 114 additions and 6 deletions
@@ -85,3 +85,11 @@ application concern belongs in the shared module.
  role into invitation mutations and rechecks a current active direct Owner
  after acquiring the SQLite write lock. The application still owns fresh
  authentication, recipient delivery, and the one-time secret presentation.
+- A real Bitwarden/Vaultwarden owner enrollment reached successful WebAuthn
+  verification but was rejected by a redundant algorithm check because the
+  application's direct response serializer omitted the optional browser
+  `publicKeyAlgorithm` convenience member. Preview 21 keeps ES256-only policy
+  enforcement but derives it from the verified COSE key embedded in
+  authenticator data. This makes the server independent of serializer-specific
+  convenience fields without weakening origin, challenge, user-verification,
+  or algorithm validation.