Skip to content

Fix webauthn CLI verification always rendering success after credential verification - #6365

Open
Hemang360 wants to merge 2 commits into
rubygems:masterfrom
Hemang360:fix-webauthn-verification
Open

Fix webauthn CLI verification always rendering success after credential verification#6365
Hemang360 wants to merge 2 commits into
rubygems:masterfrom
Hemang360:fix-webauthn-verification

Conversation

@Hemang360

Copy link
Copy Markdown
Contributor

When authenticating via Webauthn during gem push, the browser would show "Failed to fetch" even though authentication succeeded and the gem was pushed. This happened because the server redirected the browser to localhost:PORT to deliver the otp, and if that redirect failed, the browser showed an error, despite the gem CLI already having the otp via polling.

Fix by removing the localhost redirect entirely. The server now always returns "success" after Webauthn verification (the same path safari already used), and the gem CLI relies on polling to receive the otp, which is already how the safari flow worked.

Fixes #4317

@codecov

codecov Bot commented Mar 25, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.47%. Comparing base (dd8f309) to head (c5fd6bf).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #6365      +/-   ##
==========================================
- Coverage   97.07%   94.47%   -2.61%     
==========================================
  Files         489      489              
  Lines       10373    10426      +53     
==========================================
- Hits        10070     9850     -220     
- Misses        303      576     +273     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Successfully pushed a gem using webauthn authentication, even though the webpage authentication failed

1 participant