authgear / authgear/authgear-server

[Login, Passkey] Internal error occurs upon triggering the Reauthenticate endpoint with accounts that have no password

Open
#2,472 0 comments 0 reactions 0 assignees View on GitHub
bug/major reported by qa
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Background

Build: Staging
Device: Chrome, Firefox on win 11, S21 FE (Android 12), iPhone 12 mini (iOS 16), Samsung note 9 (Android 12)

## Steps

1. Sign in anonymously to an application that has enabled passkey (e.g. demo webapp cookie)
2. Promote the anonymous user
3. Sign up using only passkeys (no password)
4. After successful sign-up, trigger the authentication process with the current account
5. See the internal server error

## Expected behavior

Should allow users to authenticate with passkeys, or should direct users to the password setup process if it is not allowed to authenticate using passkeys

## Screenshots

[https://user-images.githubusercontent.com/67095825/190626943-28569dbf-3a77-4330-872d-67831b773f8c.mp4]()

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Reauthenticate endpoint flow with an account created using only passkeys, then trace the passkey authentication path for passwordless accounts. Done means the endpoint no longer returns an internal server error and either authenticates with passkeys or directs the user to password setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.