WebAuthn 2FA not working on Safari 14 #9601

New Issue

GiteaMirror · 2025-11-02T08:44:09-06:00

GiteaMirror commented

2025-11-02 08:44:09 -06:00

Originally created by @jabberabbe on GitHub (Sep 22, 2022).

Description

Hi, I can successfully register a FIDO2 token (a YubiKey) after registration on Gitea, but I am unable to use it as a second factor for subsequent login attempts when I use Safari.

Safari requires the WebAuthn API (or at least the navigation.credentials.create function) to be called from a user gesture handler. This is explained well in the YubiKey support page and on this official WebKit blog post (see the "Propagating User Gestures" section). Apparently Gitea calls the WebAuthn JS API as soon as the /user/webauthn page is loaded. No user gesture is detected and therefore Safari rejects the request.

Moreover, when the This request has been cancelled by the user. alert is shown, the user has the option to reload the page, but the problem happens again. If the user presses 'Cancel', there is no button in the page to restart the WebAuthn API flow. Adding this simple button could solve the issue.

Screenshots

Error in the user page:

Safari developer tools Console:

Page when the alert is closed, without any button to restart the WebAuthn login process:

Gitea Version

1.17.2

Can you reproduce the bug on the Gitea demo site?

Yes

Operating System

macOS Big Sur 11.4

Browser Version

Safari 14.1.1

Originally created by @jabberabbe on GitHub (Sep 22, 2022). ### Description Hi, I can successfully register a FIDO2 token (a YubiKey) after registration on Gitea, but I am unable to use it as a second factor for subsequent login attempts when I use Safari. Safari requires the WebAuthn API (or at least the `navigation.credentials.create` function) to be called from a user gesture handler. This is explained well in the [YubiKey support page](https://support.yubico.com/hc/en-us/articles/360022004600-No-reaction-when-using-WebAuthn-on-macOS-iOS-and-iPadOS) and on [this official WebKit blog post](https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/) (see the "Propagating User Gestures" section). Apparently Gitea calls the WebAuthn JS API as soon as the `/user/webauthn` page is loaded. No user gesture is detected and therefore Safari rejects the request. Moreover, when the `This request has been cancelled by the user.` alert is shown, the user has the option to reload the page, but the problem happens again. If the user presses 'Cancel', there is no button in the page to restart the WebAuthn API flow. Adding this simple button could solve the issue. ### Screenshots Error in the user page: ![image](https://user-images.githubusercontent.com/12698563/191712851-a9a891c3-606f-46fe-a627-0c491fcb3d46.png) Safari developer tools Console: <img width="1323" alt="image" src="https://user-images.githubusercontent.com/12698563/191713239-ce1f1338-453d-4927-bbdb-e482faec2225.png"> Page when the alert is closed, without any button to restart the WebAuthn login process: <img width="835" alt="image" src="https://user-images.githubusercontent.com/12698563/191715967-4bce7366-e835-4328-9efd-c613394d2638.png"> ### Gitea Version 1.17.2 ### Can you reproduce the bug on the Gitea demo site? Yes ### Operating System macOS Big Sur 11.4 ### Browser Version Safari 14.1.1

GiteaMirror added the topic/ui type/bug labels 2025-11-02 08:44:09 -06:00

GiteaMirror commented

2025-11-02 08:44:10 -06:00

@m42e commented on GitHub (Oct 23, 2022):

I tried this, too. On Mac it offers the possibility to use the fingerprint as a security key, too. This works fine for me.
I checked the requests and it turned out that the attestationObject is much longer in case of the yubikey. I haven't digged into it, but may this be an issue?

EDIT: Doesn't seem so, the data firefox sends is as long as the one safari sends. the content however differs.

@m42e commented on GitHub (Oct 23, 2022): I tried this, too. On Mac it offers the possibility to use the fingerprint as a security key, too. This works fine for me. I checked the requests and it turned out that the `attestationObject` is much longer in case of the yubikey. I haven't digged into it, but may this be an issue? **EDIT**: Doesn't seem so, the data firefox sends is as long as the one safari sends. the content however differs.

GiteaMirror commented

2025-11-02 08:44:10 -06:00

@lunny commented on GitHub (Mar 8, 2023):

Is this still a problem in v1.18 ?

@lunny commented on GitHub (Mar 8, 2023): Is this still a problem in v1.18 ?

GiteaMirror commented

2025-11-02 08:44:10 -06:00

@wxiaoguang commented on GitHub (Mar 8, 2023):

I guess Apple has changed the behavior again, my old Safari can reproduce this issue, but my new Safari could work well.

@wxiaoguang commented on GitHub (Mar 8, 2023): I guess Apple has changed the behavior again, my old Safari can reproduce this issue, but my new Safari could work well.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9601