Repository navigation
Conversation
The passkey verify route turned every PasskeyAuthenticationError into the same 401 "Authentication failed" and logged nothing, so a site owner could not tell an unknown passkey from an origin mismatch or an expired challenge, not even in the server logs. Log the error code with console.warn. The code comes from a closed union, while some error messages embed values from the request, so only the code is logged. The response stays the same. The authentication guide's troubleshooting entry now points to the log line and the codes a site owner can act on.
🦋 Changeset detectedLatest commit: b1a26ba The changes in this PR will be included in the next version bump. This PR includes changesets to release 12 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
review/needs-review
![emdashbot[bot]](https://avatars.githubusercontent.com/in/3255304?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
The approach is sound and narrowly scoped. Every PasskeyAuthenticationError previously produced the same 401 with no log, so operators could not diagnose #4645. A single console.warn with the error code fixes that, leaves the 401 response unchanged, and avoids logging request-derived messages such as the client origin. Both reviewers approved and found nothing to fix. They checked that the documented error codes exist, the doc anchors resolve, and the changeset is an appropriate patch bump. They also found that the tests use real credentials and challenges and assert both the logged code and the unchanged 401. The review was static, so tests and builds were not run. The change does not claim to fix the underlying sign-in failure.
Reviewed by anthropic/claude-opus-5-5 and openai/gpt-6.1-sol.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
docs | b1a26ba | Nov 07 2026, 08:50 PM |
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://daniel-log-passkey-signin-rejection.try.emdashcms.com, https://daniel-log-passkey-signin-rejection-emdash-playground.emdash-cms.workers.dev (commit b1a26ba)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/auth-atproto
@emdash-cms/blocks
@emdash-cms/cloudflare
@emdash-cms/contentful-to-portable-text
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/plugin-cli
@emdash-cms/plugin-test
@emdash-cms/plugin-types
@emdash-cms/registry-client
@emdash-cms/registry-lexicons
@emdash-cms/registry-loader
@emdash-cms/registry-moderation
@emdash-cms/registry-verification
upgrade-emdash
@emdash-cms/sandbox-workerd
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-ai-search
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-field-kit
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds the reason to the server logs when a passkey sign-in is rejected. Until now the verify route turned each
PasskeyAuthenticationErrorinto the same 401 and logged nothing, so nobody could tell an unknown passkey from a wrong site address or an expired challenge, not even in the Workers logs. In #4645 a passkey sign-in started failing after an update, and the cause is still unknown.The route now logs
[passkey] sign-in rejected: <code>. Some error messages include values from the request, so only the code is logged. The response is unchanged. The authentication guide explains the log line.The passkey registration routes already log why a passkey was rejected.
#4189 went further and explained an unknown passkey on the login page. It was closed as a stale draft, and this change doesn't get in its way.
Related to #4645
Type of change
Your connection to this change
I'm a Maintainer, and I chose this change while triaging #4645.
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpasses (or targeted tests for my change)pnpm formathas been runmessages.pochanges except in translation PRs — a workflow extracts catalogs on merge tomain. (n/a: no admin UI change)AI assistance disclosure
Screenshots / test output
Not applicable, no UI change.
New cases in
passkey-verify-route.test.tssend an unknown passkey and a passkey from another origin. They check the logged code and the unchanged 401, and both failed before the change. They replace the older unknown-passkey case. Ondemos/simple, posting an unknown passkey to the verify route returns the same 401 body and logs[passkey] sign-in rejected: credential_not_found.