mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-20 00:19:00 +00:00
a25d1d77eb
28.0.0 bumped `github.com/go-webauthn/webauthn` from v0.17.4 to v0.18.x. v0.18.0 made the ceremony fail whenever the client returns a client extension output the relying party did not request, unless `Config.ExtensionsUnsolicitedOutputPolicy` says otherwise; the strict behavior is the zero value, so not configuring a policy opts into it (upstream MIGRATION.md §2.4). Every security-key and passkey login from Safari on iOS fails with 403: Client returned the "appid" extension output which was not requested To fix, set `ExtensionsUnsolicitedOutputPolicy: protocol.UnsolicitedOutputPolicyIgnore` in the webauthn config Fixes #39790 --------- Signed-off-by: choksi2212 <choksi2212@users.noreply.github.com> Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: choksi2212 <choksi2212@users.noreply.github.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>