corbado / passkey-tutorial Goto Github PK

You must include the user.id in credentialService.getCredentialByCredentialId in handleLoginFinish function.

If you have 2 logins from the same device, you must include the user.id in the database query.

In services/credentialService.ts (line 23)
async getCredentialByCredentialId(credentialId: string, userID: string): Promise<AuthenticatorDevice | null> { try { const [rows] = await promisePool.query( "SELECT * FROM credentials WHERE credential_id = ? AND user_id = ? LIMIT 1", [credentialId, userID] ); ...

In controllers/authentication.ts (line 54)
const dbCredential: AuthenticatorDevice | null = await credentialService.getCredentialByCredentialId( credentialID, loggedInUserId );

Costis

I tested this out and notice this error in Safari 17.2.1.

sql: "INSERT INTO credentials (user_id, credential_id, public_key, counter, transports) VALUES ('f04bf801-e185-4061-b233-c183d953c9cf', 'lf5E3aMz9/Z98aX/5+cotUfDfkU=', 'pQECAyYgASFYIIc7bKcJroIFbo0Mc6MhZNAglkJPKdKUoYNcHP4UZodLIlgg84z56dl8QVodbitj03Mrtlkl1po1NCWTuRxX7Aczlwo=', 0, 'internal', 'hybrid')",
app-1 | sqlState: '21S01',
app-1 | sqlMessage: "Column count doesn't match value count at row 1"

I think the issue is the column transports in table credentials did not consider two values returned from iCloud Keychain : internal and hybrid.

on src/controllers/registration.ts/handleRegisterFinish function, body.response.transports is an array of strings. It used to be one of the following: "usb", "nfc", "ble", or "internal", but recently, both "internal" and "hybrid" could be returned at the same time, causing the error above