Release 1.3.1 #6

Merged

renekreijveld merged 2 commits from develop into main

2026-11-13 09:35:44 +00:00

renekreijveld commented

2026-11-13 09:35:42 +00:00

Owner

Release 1.3.1: develop into main.

Fixed

A failed passkey login logs the username the passkey was requested for

Release 1.3.1: develop into main. ### Fixed - A failed passkey login logs the username the passkey was requested for

renekreijveld added 2 commits

2026-11-13 09:35:42 +00:00

fix: A failed passkey login logs the username the passkey was requested for 590e5115d9

A failed passkey login ("Log in with a passkey", plg_system_webauthn)
already triggered onUserLoginFailure and was logged as LOGINFAIL, but
with an empty username (user=-): the passkey plugin passes an empty
authentication response. The plugin now takes the user from the session
(plg_system_webauthn.userId, set by the challenge request and cleared
only after the failure event). Without a challenge for an existing user
it stays user=-.

A passkey used as the second factor (MFA) whose signature does not verify
was already logged as MFAFAIL; the README now says so.

Tested in DDEV with invalid passkey assertions: login after a challenge
for admin (user=admin), login without a challenge (user=-), and the
passkey MFA method (MFAFAIL, try counter of the passkey record raised).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(release): 1.3.1 576471a602

renekreijveld merged commit afc361a663 into main

2026-11-13 09:35:44 +00:00

renekreijveld referenced this pull request from a commit

2026-11-13 09:35:46 +00:00

Merge pull request 'Release 1.3.1' (#6) from develop into main