WebAuthn cryptically not working in production but works perfectly in development

IAmKale · October 25, 2022, 7:18pm

The site probably works locally because “localhost” is considered a secure context, but an http:// address is not. The “Error while registering” at the start of the error message OP posted would line up with this logic in the except block that tries to handle registration:

github.com

redwoodjs/redwood/blob/main/packages/auth-providers-web/src/dbAuth/webAuthn.ts#L177-L179


      
          throw new WebAuthnRegistrationError(
            `Error while registering: ${e.message}`
          )

Get some HTTPS on spoonjoy.co and I’ll bet you that’ll solve the problem.

P.S. WOW the throttling here is annoying, I split this up into two to get past the “two URLs only” rule and ran into the “30 seconds between posts” rule

arimendelow · October 25, 2022, 7:19pm

Ha! No, spoonjoy.co is an older attempt at building Spoonjoy that’s unrelated, I totally forgot that was up - the .app domain is the correct one, and does use HTTPS

IAmKale · October 25, 2022, 7:20pm

I spent so long fighting the platform that I missed your update! Let me catch up.

IAmKale · October 25, 2022, 7:25pm

Alright, I threw the request data included in the call to https://spoonjoy.app/api/auth into https://debugger.simplewebauthn.dev, and the debugger parsed the JSON just fine, so I don’t think any data is malformed on the front end:

Which would mean the search should turn towards the logic that receives the request, and what it does with the data before trying to verify it.

IAmKale · October 25, 2022, 7:32pm

@rob I’m apparently helping too quickly because all of my posts in here were “flagged by the community” as spam. Can you help me out here? I can’t continue to help here if the forums are going to keep treating me like this.

PantheRedEye · October 25, 2022, 7:34pm

@IAmKale - I upgraded your membership to trust level 2: member level - hopefully that will help.

It looks like a message or two is still flagged for review. I am not sure if the membership level change will help with further posts.

IAmKale · October 25, 2022, 7:37pm

The last place I wanted to suggest starting to debug this is within webauthnRegister(), or whatever logic within Spoonjoy eventually makes the request to this method:

github.com

redwoodjs/redwood/blob/main/packages/auth-providers-api/src/dbAuth/DbAuthHandler.ts#L884


      
          
          
// browser submits WebAuthn credentials for the first time on a new device
          async webAuthnRegister() {
            const { verifyRegistrationResponse } = require('@simplewebauthn/server')
          
          
  if (this.options.webAuthn === undefined || !this.options.webAuthn.enabled) {
              throw new DbAuthError.WebAuthnError('WebAuthn is not enabled')
            }
          
          
  const user = await this._getCurrentUser()
            const jsonBody = JSON.parse(this.event.body as string)
          
          
  let verification: VerifiedRegistrationResponse
            try {
              const options: VerifyRegistrationResponseOpts = {
                credential: jsonBody,
                expectedChallenge: user[this.options.authFields.challenge as string],
                expectedOrigin: this.options.webAuthn.origin,
                expectedRPID: this.options.webAuthn.domain,
                requireUserVerification: true,
              }

Maybe this is a case of this.event.body being undefined for some reason? That’s the best guess I have for you without seeing any Spoonjoy code (which I’m definitely not asking for access to, to be clear! )

arimendelow · October 25, 2022, 7:40pm

Yeah it’s just using this, hm

IAmKale · October 25, 2022, 7:42pm

Can you share the Spoonjoy handler that receives the JSON registration body and then attempts to verify it?

arimendelow · October 25, 2022, 7:44pm

That’s all in the open source RedwoodJS code, here’s the documentation for that: Self-hosted Authentication (dbAuth) | RedwoodJS Docs

And the error is thrown specifically in this line: redwood/webAuthn.ts at 7b877e56647c5b5baa5eaa888b35e942e4500e0b · redwoodjs/redwood · GitHub

arimendelow · October 25, 2022, 7:45pm

If you check out this above comment you can see that I’ve verified that the JSON is being properly stringified

arimendelow · October 25, 2022, 7:46pm

I’ll also try out Rob’s above suggestion in a bit and report back here

IAmKale · October 25, 2022, 7:48pm

Based on what I’m seeing in Chrome, that line is likely erroring out because it gets back an HTTP 400 from the server:

Screen Shot 2022-10-25 at 12.46.09 PM

Screen Shot 2022-10-25 at 12.46.13 PM

Which is telling me that the error is actually getting thrown somewhere in the backend.

If you check out this above comment you can see that I’ve verified that the JSON is being properly stringified

And I believe this too, based on the request payload looking fine to me too:

We’re seeing the same thing, right?

Edit: I guess the HTTP 400 is properly getting caught here:

github.com

redwoodjs/redwood/blob/7b877e56647c5b5baa5eaa888b35e942e4500e0b/packages/auth-providers-web/src/dbAuth/webAuthn.ts#L197-L199


      
          } catch (e: any) {
            throw new WebAuthnRegistrationError(`Error while registering: ${e.message}`)
          }

arimendelow · October 25, 2022, 7:48pm

Yeah, that’s the same thing I’m seeing

rob · October 25, 2022, 7:49pm

Do you have any logging setup on the api side so you can see if something is being thrown there?

arimendelow · October 25, 2022, 7:56pm

Sort of, I’ve got the default logging from Vercel and Railway - Vercel is showing no errors being thrown:

Weirdly, on this call, it doesn’t look like anything is happening on Railway’s end.

rob · October 25, 2022, 7:58pm

The database (Railway) should only get involved if the register is successful, the api side inserts their credentials into that UserCredential table. Can you open up the UserCredential table in some kind of Railway UI and see if any records have been inserted?

rob · October 25, 2022, 8:01pm

@IAmKale What do you think about the error message being “Unexpected token e in JSON at position 0” and the fact that the clientBodyJSON’s first character is the letter “e”?

clientDataJSON: "eyJ0eXBlIjoid2ViYXV0aG4uY3JlY..."

Just a coincidence?

arimendelow · October 25, 2022, 8:02pm

This actually gets weirder, because I’m not seeing any tables whatsoever on Railway’s side

What could I be missing here, hmmmmm

rob · October 25, 2022, 8:03pm

Did a yarn rw prisma migrate deploy ever happen? That should automatically happen if you use our Vercel deploy strategy though…