authgear / authgear/authgear-server
[Login, Passkey] Internal error occurs upon triggering the Reauthenticate endpoint with accounts that have no password
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Background
Build: Staging
Device: Chrome, Firefox on win 11, S21 FE (Android 12), iPhone 12 mini (iOS 16), Samsung note 9 (Android 12)
## Steps
1. Sign in anonymously to an application that has enabled passkey (e.g. demo webapp cookie)
2. Promote the anonymous user
3. Sign up using only passkeys (no password)
4. After successful sign-up, trigger the authentication process with the current account
5. See the internal server error
## Expected behavior
Should allow users to authenticate with passkeys, or should direct users to the password setup process if it is not allowed to authenticate using passkeys
## Screenshots
[https://user-images.githubusercontent.com/67095825/190626943-28569dbf-3a77-4330-872d-67831b773f8c.mp4]()
Contributor guide
Research direction
Start by reproducing the Reauthenticate endpoint flow with an account created using only passkeys, then trace the passkey authentication path for passwordless accounts. Done means the endpoint no longer returns an internal server error and either authenticates with passkeys or directs the user to password setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100