fix: recognize 401 step-up-required on passkey enrollment denial (SUF-02) - #91
Merged
Merged
Conversation
…-02) The framework's stale/factorless-session denial on POST /webauthn/register changed in ds-spring-user-framework 5.3.4 from a bare 403 to a 401 carrying error code "step-up-required" (StepUpEnrollmentAccessDeniedHandler, library #371), matching the passkey delete/rename endpoints. webauthn-register.js only branched on 403, so against 5.3.4 a stale-session enrollment fell through to the generic "Failed to register passkey. Please try again." instead of the actionable "sign out and sign in again" message, and the chromium-step-up E2E (step-up-flow.spec.ts:320) failed. Recognize both: 403 (framework < 5.3.4) or 401 with error code "step-up-required" (5.3.4+) now raise PasskeyEnrollmentStepUpError. Backward-compatible, so the test passes whether the demo is pinned to 5.3.3 or bumped to 5.3.4. Verified locally against a 5.3.4-SNAPSHOT publishLocal build: chromium-step-up 8/8. Claude-Session: https://claude.ai/code/session_01KL5qvKVGQLLQDjHToy34vj
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new error-handling path can throw “body stream already read” because it calls response.json() and then falls back to response.text() on the same response without cloning/rehydrating the body.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the demo app’s WebAuthn passkey enrollment client logic to correctly interpret the Spring User Framework’s changed “step-up required” denial semantics (403 pre-5.3.4 vs 401 with error: "step-up-required" in 5.3.4+), so the UI can show the actionable “sign in again” messaging and E2E step-up flows remain compatible across framework versions.
Changes:
- Expand
PasskeyEnrollmentStepUpErrordocumentation to reflect the framework’s 5.3.4+401 step-up-requiredbehavior. - Treat both legacy
403and new401 + errorCode=step-up-requiredas passkey-enrollment step-up denial and throwPasskeyEnrollmentStepUpErroraccordingly.
File summaries
| File | Description |
|---|---|
src/main/resources/static/js/user/webauthn-register.js |
Recognize both 403 and 401(step-up-required) denial shapes during passkey enrollment to keep step-up UX/E2E behavior consistent across SUF versions. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
102
to
111
| let msg = 'Registration failed'; | ||
| let errorCode; | ||
| try { | ||
| const data = await finishResponse.json(); | ||
| msg = data.message || msg; | ||
| errorCode = data.error; | ||
| } catch { | ||
| const text = await finishResponse.text(); | ||
| if (text) msg = text; | ||
| } |
devondragon
added a commit
that referenced
this pull request
Aug 22, 2026
5.3.4 fixes concurrent passwordless-registration deadlocks and aligns the passkey enrollment freshness denial to HTTP 401 + step-up-required (library #371), which the demo's webauthn-register.js (updated in #91) and chromium-step-up E2E now handle. Claude-Session: https://claude.ai/code/session_01KL5qvKVGQLLQDjHToy34vj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The framework's stale/factorless-session denial on
POST /webauthn/registerchanged inds-spring-user-framework5.3.4 from a bare403to a401carrying error codestep-up-required(StepUpEnrollmentAccessDeniedHandler, library #371), matching the passkey delete/rename endpoints so a client can interpret it.webauthn-register.jsonly branched on403, so against 5.3.4 a stale-session enrollment fell through to the generic "Failed to register passkey. Please try again." instead of the actionable "sign out and sign in again" message. Thechromium-step-upE2E (step-up-flow.spec.ts:320) failed on that.The fix recognizes both denial shapes:
403(framework < 5.3.4) or401with error codestep-up-required(5.3.4+) now raisePasskeyEnrollmentStepUpError. Backward-compatible, so the E2E passes whether the demo is pinned to 5.3.3 (current) or bumped to 5.3.4.Testing
Verified locally against a
5.3.4-SNAPSHOTpublishLocalbuild of the framework:chromium-step-upsuite 8/8 passed. Against the current 5.3.3 pin the 403 path is unchanged.Companion framework migration note: devondragon/SpringUserFramework#373.
https://claude.ai/code/session_01KL5qvKVGQLLQDjHToy34vj