bitwarden / bitwarden/passwordless-server
Wrong `credentialId` returned from `/signin/verify` endpoint
- Dominant language
- C#
- Stars
- 145
- Forks
- 49
- PR merge metrics
- No merged PRs in 30d
Description
The `/signin/verify` endpoint is returning an incorrect `credentialId`. When hitting this endpoint with a token to verify passkey sign-in, the response contains a `credentialId` that does not match the expected value.
In the Admin console, the `credentialId` for the passkey is: `gC-5YbmlbT2S9qv4uv1aIw`, which I assume is correct. However, when I try to verify the sign-in, the response returns this `credentialId`: `gC+5YbmlbT2S9qv4uv1aIw==`, which differs from the one in the Admin console.
Below I have shared images for reference:
Contributor guide
Research direction
Start by locating the /signin/verify endpoint and tracing where its passkey credentialId is produced. Compare that value with the Admin console value shown in the report, then add or update coverage so verification returns the expected credentialId representation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100