update the webauthn crate #1167

New Issue

MrUnknownDE · 2026-04-06T01:41:22+02:00

MrUnknownDE commented

2026-04-06 01:41:22 +02:00

Originally created by @stefan0xC on 4/9/2024

I have been working on updating the webauthn_rs crate (as basis to implement passkey support).

The feature danger-allow-state-serialisation is used to serialize the state into the database, which should be fine according to: https://docs.rs/webauthn-rs/0.4.8/webauthn_rs/index.html#allow-serialising-registration-and-authentication-state

I've also decided to remove the u2f migration because it would have required the use of the more low level, protocol interactions provided by the webauthn_core_rs crate, so I guess this could be considered a breaking change? (If this is deemed necessary I can revert the removal, I mainly did it because upgrading the crate was tedious enough.)

I could not actually test the changes because I don't have a security key myself. And therefore I also don't know if it addresses the issues raised in https://github.com/dani-garcia/vaultwarden/issues/4196 (but I think it should be easier with the use of the Safe API?). So someone else definitely needs to test it and/or take over this PR.

*Originally created by @stefan0xC on 4/9/2024* I have been working on updating the `webauthn_rs` crate (as basis to implement passkey support). The feature `danger-allow-state-serialisation` is used to serialize the state into the database, which should be fine according to: https://docs.rs/webauthn-rs/0.4.8/webauthn_rs/index.html#allow-serialising-registration-and-authentication-state I've also decided to remove the u2f migration because it would have required the use of the more low level, protocol interactions provided by the [webauthn_core_rs](https://docs.rs/webauthn-rs-core/latest/webauthn_rs_core/) crate, so I guess this could be considered a breaking change? (If this is deemed necessary I can revert the removal, I mainly did it because upgrading the crate was tedious enough.) I could not actually test the changes because I don't have a security key myself. And therefore I also don't know if it addresses the issues raised in https://github.com/dani-garcia/vaultwarden/issues/4196 (but I think it should be easier with the use of the Safe API?). So someone else definitely needs to test it and/or take over this PR.

MrUnknownDE closed this issue

2026-04-06 01:41:22 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1167