Tag: webauthn
All the articles with the tag "webauthn".
Five minutes on the login page: an expired passkey challenge shouldn't be a 500
If a user left the login page open for more than five minutes and then signed in with a passkey, ASP.NET Core Identity threw instead of returning SignInResult.Failed. Notes on PR #67539: where the challenge actually lives, why it expires, and where to draw the line between a failed sign-in and a programming error.
ES256 doesn't mean P-256 (unless you check): fixing passkey key validation in ASP.NET Core
A passkey public key carries an algorithm and a curve, and WebAuthn says they have to agree. ASP.NET Core Identity didn't check that. Notes on PR #68834: where the gap comes from, what a mismatched key actually does in .NET, and the fix.