c020af4c09
Even with authenticatorAttachment=cross-platform, Bitwarden's extension intercepted navigator.credentials.create and offered to save a passkey. Add the WebAuthn L3 'hints: [security-key]' to both registration and assertion options; browsers and passkey managers that honor hints step aside and let the hardware key prompt through. Injected into the client payload only (the session copy used for server validation is unchanged). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| .gitkeep | ||
| DeploymentService.php | ||
| Fail2banService.php | ||
| FirewallService.php | ||
| FleetService.php | ||
| HardeningService.php | ||
| MaintenanceService.php | ||
| SessionService.php | ||
| SshKeyProvisioner.php | ||
| WebauthnService.php | ||