From db64b150be9046ee971f520b4c30f3b3d434facf Mon Sep 17 00:00:00 2001 From: Elias Schneider Date: Mon, 3 Aug 2026 20:20:40 +0200 Subject: [PATCH] fix: disable api key auth for webauthn register endpoints --- backend/internal/bootstrap/router_bootstrap.go | 1 + backend/internal/webauthn/module.go | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/backend/internal/bootstrap/router_bootstrap.go b/backend/internal/bootstrap/router_bootstrap.go index 8544ed74..d92f7174 100644 --- a/backend/internal/bootstrap/router_bootstrap.go +++ b/backend/internal/bootstrap/router_bootstrap.go @@ -157,6 +157,7 @@ func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, rateLimitServices ) svc.webauthnModule.RegisterRoutes(apiGroup, authMiddleware.WithAdminNotRequired().Add(), + authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add(), rateLimitMiddleware.Add(middleware.RateLimitWebauthnLogin), rateLimitMiddleware.Add(middleware.RateLimitWebauthnReauthenticate), ) diff --git a/backend/internal/webauthn/module.go b/backend/internal/webauthn/module.go index b26cefdd..f5f49543 100644 --- a/backend/internal/webauthn/module.go +++ b/backend/internal/webauthn/module.go @@ -56,16 +56,16 @@ func New(deps Dependencies) (*Module, error) { } // RegisterRoutes mounts the WebAuthn registration, login and reauthentication endpoints -func (m *Module) RegisterRoutes(apiGroup *gin.RouterGroup, userAuth, loginRateLimit, reauthRateLimit gin.HandlerFunc) { - apiGroup.GET("/webauthn/register/start", userAuth, httpserver.Handle(m.handler.beginRegistration)) - apiGroup.POST("/webauthn/register/finish", userAuth, httpserver.Handle(m.handler.verifyRegistration)) +func (m *Module) RegisterRoutes(apiGroup *gin.RouterGroup, userAuth, browserAuth, loginRateLimit, reauthRateLimit gin.HandlerFunc) { + apiGroup.GET("/webauthn/register/start", browserAuth, httpserver.Handle(m.handler.beginRegistration)) + apiGroup.POST("/webauthn/register/finish", browserAuth, httpserver.Handle(m.handler.verifyRegistration)) apiGroup.GET("/webauthn/login/start", httpserver.Handle(m.handler.beginLogin)) apiGroup.POST("/webauthn/login/finish", loginRateLimit, httpserver.Handle(m.handler.verifyLogin)) apiGroup.POST("/webauthn/logout", userAuth, httpserver.Handle(m.handler.logout)) - apiGroup.POST("/webauthn/reauthenticate", userAuth, reauthRateLimit, httpserver.Handle(m.handler.reauthenticate)) + apiGroup.POST("/webauthn/reauthenticate", browserAuth, reauthRateLimit, httpserver.Handle(m.handler.reauthenticate)) apiGroup.GET("/webauthn/credentials", userAuth, httpserver.Handle(m.handler.listCredentials)) apiGroup.PATCH("/webauthn/credentials/:id", userAuth, httpserver.Handle(m.handler.updateCredential))