Repository navigation
feat(portal): passkeys as a second factor - #90
Merged
Merged
Conversation
Adds the page the app opens in the browser to create or use a passkey (/2fa/passkey), a passkey button at the portal's own sign-in, and the same button where a password change asks for a second factor. The page takes a one-time handle from the URL fragment, drops it from the address bar, shows the account and what was asked for, and sends the browser on to the address the server names once the passkey has answered. Sign-in, sign-up and the new page now share one page shell.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Portal side of VoltiusApp/server#106, passkeys as a second factor. Safe to merge before the server PR: against a server without passkeys the button never shows and
/2fa/passkeysays the request cannot be checked.What changes
/2fa/passkey, the page the app opens in the browser to create or use a passkey. It reads a one-time handle from the URL fragment, removes it from the address bar, names the account and what was asked for, and after the passkey prompt sends the browser to the address the server returns (the app's listener on127.0.0.1, or avoltius://link).AuthShell) instead of three copies.No passkey management here: adding and removing is done in the app.
Checked
Chromium with a virtual authenticator, portal dev server against the server branch: create a passkey through the page, sign in on the portal with it, finish an app-style sign-in through the page, change the password with it, stale handle, done state. Typecheck passes. Not checked in Safari or Firefox.