Security key login fails with DataCloneError: Proxy object could not be cloned

Steps to reproduce

1. Register a security key as a second factor
2. Log out, log in, pick the security key
3. Nothing happens and the browser console shows the error below

Actual behaviour

[ERROR] twofactor_webauthn: challenge failed
Object { app: "twofactor_webauthn", uid: "…", level: 2, error: DOMException }
error: DOMException: Proxy object could not be cloned.

Cause

Challenge.vue passes credentialRequestOptions straight into startAuthentication():

authResponse = await startAuthentication({
    optionsJSON: this.credentialRequestOptions,
})

The value arrives from the Pinia store, so under Vue 3 it is a reactive Proxy. startAuthentication() forwards it to navigator.credentials.get(), which structured-clones its argument — and a Proxy cannot be cloned.

The frontend moved to Vue 3 in 2.2.0, which is when this would have started.

Suggested fix

Unwrap before the call:

import { toRaw } from 'vue'

authResponse = await startAuthentication({
    optionsJSON: structuredClone(toRaw(this.credentialRequestOptions)),
})

optionsJSON is a PublicKeyCredentialRequestOptionsJSON, so it holds JSON values only — the challenge and credential IDs are base64url strings, not ArrayBuffers. A deep clone loses nothing.

What I verified

I patched the built bundle on my instance:

ij({optionsJSON:n.credentialRequestOptions})
→ ij({optionsJSON:JSON.parse(JSON.stringify(n.credentialRequestOptions))})

Security key login works after that.

Registration takes the same code path in login-setup.js and settings.js, but there the options come straight from the server response, so no Proxy is involved and I saw no failure.

Versions

• twofactor_webauthn 2.7.0
• Nextcloud 34.0.3
• Firefox

This does not hit every user — whether it fails depends on how strictly the browser enforces structured cloning on the argument, so a Chromium test would be worth adding to this report.

Start in Challenge.vue at the startAuthentication() call and inspect how credentialRequestOptions is passed to the browser credential API. Confirm the request options are no longer a reactive Proxy, then verify that security key login completes without the DataCloneError; login-setup.js and settings.js provide the related registration paths for comparison.