Skip to content

user.id encoding on create request #90

@jdalyglo

Description

@jdalyglo

Hi folks,

This is an extension of issue:
#81

Behaviour:
On creation of passkey, we are base64url encoding the user id. In our case our passkeys providor (Ping Identity) does not use a string user id - its a binary representation of the user id.
The create works successfully & the authentication wrks correctly on IOS.
But... when we try to use the passkey on a web journey (browser using webauthn but with the same passkey rpid), we're getting a failure because the userHandle (in the get response) is not matching the expected user.id from the create. In our case its been double base64 encoded.

It appears that the user id is not being decoded correctly at this line:
https://github.com/f-23/react-native-passkey/blob/stable/ios/Passkey.swift#L39C25-L39C29

In our opinion user.id should be decoded from base64url encoded string (like the challenge is). I think that because the user id in our case is not a String, then UTF-8 encoding is not sufficient for this.

In Android, the native CredentialManager expects the user id as a base64 encoded string - so it should always be encoded as base64 on the way into this module.

We will patch locally (have tested across IOS RN app, Android RN app, browser on each OS) but would submit a PR if this issue were confirmed.

Comments appreciated.
Thanks,
John.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions