-
Notifications
You must be signed in to change notification settings - Fork 54
Description
Hi folks,
This is an extension of issue:
#81
Behaviour:
On creation of passkey, we are base64url encoding the user id. In our case our passkeys providor (Ping Identity) does not use a string user id - its a binary representation of the user id.
The create works successfully & the authentication wrks correctly on IOS.
But... when we try to use the passkey on a web journey (browser using webauthn but with the same passkey rpid), we're getting a failure because the userHandle (in the get response) is not matching the expected user.id from the create. In our case its been double base64 encoded.
It appears that the user id is not being decoded correctly at this line:
https://github.com/f-23/react-native-passkey/blob/stable/ios/Passkey.swift#L39C25-L39C29
In our opinion user.id should be decoded from base64url encoded string (like the challenge is). I think that because the user id in our case is not a String, then UTF-8 encoding is not sufficient for this.
In Android, the native CredentialManager expects the user id as a base64 encoded string - so it should always be encoded as base64 on the way into this module.
We will patch locally (have tested across IOS RN app, Android RN app, browser on each OS) but would submit a PR if this issue were confirmed.
Comments appreciated.
Thanks,
John.