Kyle Isom
446b3df52d
- Fix webauthn.js CSRF token: read HMAC header value from body hx-headers attribute instead of cookie nonce - Update profile labels to mention security keys/FIDO2 alongside passkeys Security: CSRF double-submit was broken for fetch()-based WebAuthn requests — JS was sending the cookie nonce as the header value instead of the HMAC. Fixed by reading the server-rendered header token from the DOM. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
20 lines
838 B
HTML
20 lines
838 B
HTML
{{define "webauthn_enroll"}}
|
|
<div id="webauthn-enroll-section">
|
|
<div id="webauthn-enroll-error" class="alert alert-error" style="display:none" role="alert"></div>
|
|
<div id="webauthn-enroll-success" class="alert alert-success" style="display:none" role="alert"></div>
|
|
<div class="form-group">
|
|
<label for="webauthn-name">Passkey Name</label>
|
|
<input class="form-control" type="text" id="webauthn-name" placeholder="e.g. YubiKey 5, Touch ID" value="Passkey">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="webauthn-password">Current Password</label>
|
|
<input class="form-control" type="password" id="webauthn-password" autocomplete="current-password">
|
|
</div>
|
|
<div class="form-actions">
|
|
<button class="btn btn-primary" type="button" id="webauthn-enroll-btn">
|
|
Add Passkey
|
|
</button>
|
|
</div>
|
|
</div>
|
|
{{end}}
|