Description

Registration of a roaming security key fails because the WebAuthn request requires resident/discoverable credentials, which such authenticators don’t support.

Environment

• Client OS: Artix Linux, KDE, Wayland
• Browser: Firefox 141.0.3 (64-bit)
• Authenticator: tpm-fido (Linux TPM → FIDO2 via UHID)
  • fido2-token -L shows:

    /dev/hidraw3: vendor=0x15d9, product=0x0a37 ( tpm-fido)
    

Steps to reproduce

1. Start the authenticator bridge:

   tpm-fido

2. On the Gitea demo site, open Settings → Security → Security Keys → Add Security Key.
3. At this moment, the authenticator log prints:

   got VersionCmd
   

   No user-presence prompt appears.
4. The browser shows:

   Could not read your security key.
   NotAllowedError: The request is not allowed by the user agent or the platform in the current context
   

Captured navigator.credentials.create() options (from DevTools on the failing page)

{
 "publicKey": {
 "rp": { "name": "xx", "id": "xx.co.uk" },
 "user": { "name": "xx", "displayName": "xx", "id": { "__type": "ArrayBuffer", "base64": "AgAAAAAAAAA=" } },
 "challenge": { "__type": "ArrayBuffer", "base64": "xxxx=" },
 "pubKeyCredParams": [
 { "type": "public-key", "alg": -7 }, { "type": "public-key", "alg": -35 },
 { "type": "public-key", "alg": -36 }, { "type": "public-key", "alg": -257 },
 { "type": "public-key", "alg": -258 }, { "type": "public-key", "alg": -259 },
 { "type": "public-key", "alg": -37 }, { "type": "public-key", "alg": -38 },
 { "type": "public-key", "alg": -39 }, { "type": "public-key", "alg": -8 }
 ],
 "timeout": 300000,
 "authenticatorSelection": { "residentKey": "required" },
 "attestation": "direct"
 }
}

Workarounds verified (in-page, DevTools console)

1) Change only resident key requirement → registration succeeds

(() => {
 const orig = navigator.credentials.create.bind(navigator.credentials);
 navigator.credentials.create = (opts) => {
 const sel = opts?.publicKey?.authenticatorSelection;
 if (sel && (sel.residentKey === 'required' || sel.requireResidentKey === true)) {
 opts.publicKey.authenticatorSelection = { ...sel, residentKey: 'preferred', requireResidentKey: false };
 }
 return orig(opts);
 };
})();

Result: user-presence prompt appears; firefox warns of collecting extra information; authenticator proceeds beyond got VersionCmd; key registers successfully.

2) Additionally set attestation to "none" → removes Firefox "extra information" consent; registration still succeeds

(() => {
 const orig = navigator.credentials.create.bind(navigator.credentials);
 navigator.credentials.create = (opts) => {
 if (opts?.publicKey) {
 if (opts.publicKey.authenticatorSelection?.residentKey === 'required' ||
 opts.publicKey.authenticatorSelection?.requireResidentKey === true) {
 opts.publicKey.authenticatorSelection = {
 ...opts.publicKey.authenticatorSelection,
 residentKey: 'preferred',
 requireResidentKey: false
 };
 }
 opts.publicKey.attestation = 'none';
 }
 return orig(opts);
 };
})();

Control test

Using the same client + authenticator, registration works on webauthn.io when configured for a security key with non-resident credentials and userVerification discouraged.

Fix / Request

Proposed fix

For the Security Keys (roaming key) MFA flow:

• Use options compatible with external roaming authenticators:
  • authenticatorSelection: { residentKey: "preferred", authenticatorAttachment: "cross-platform", userVerification: "preferred", requireResidentKey: false }
  • attestation: "none" (removes extra-info prompts; still works)
• Alternatively, expose the above as per-instance settings so admins can choose.

Optional UX improvement:

• Provide two explicit buttons/flows with appropriate defaults:
  1. Add Security Key (USB/NFC) → for 2FA

     authenticatorSelection: {
      residentKey: "preferred",
      authenticatorAttachment: "cross-platform",
      userVerification: "preferred",
      requireResidentKey: false
     }
     attestation: "none"

  2. Add Passkey (this device) → for passwordless

     authenticatorSelection: {
      residentKey: "required",
      authenticatorAttachment: "platform",
      userVerification: "required"
     }
     attestation: "none" // or "indirect"

Gitea Version

1.24.5

Can you reproduce the bug on the Gitea demo site?

Yes

How are you running Gitea?

https://demo.gitea.com/