devise-webauthn 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f958718af83cd2bdae3d3c08d8ac72678e2e313b93eabdc7effe1af70bda300f
-  data.tar.gz: ea997a0537ca6a68d97e7aedbff6993331eeebab1857b2d7a26177987efe7571
+  metadata.gz: 2c1fc0044f5c2bf947d79fd3db30ea05907980dac2abeacd4d43af55c7fc8fc3
+  data.tar.gz: d9513c05eaad396f2d6f8764a8f8964086678fa03e55b98375406e1de7303b67
 SHA512:
-  metadata.gz: e81d1880a7b6722c150b9cdd3fcabcbc07128ab5beaea22c580a6ff5d6338ac108ed55728f876eb9635e087787c875fca246de6ed307450f53907b14eadc5c5d
-  data.tar.gz: 0fe56be79a56f2ca46349ebd4e9ce1ed1f3f43df73cb7acde76a0aebce4dae4cf022c8cc01dba53c89c9d0b637145474f169cab0b4f7f4811788fdc7b0fe2479
+  metadata.gz: 53c013359a84a25616c4a4778a4e0c766916665d7c31192b74feab1f471f36ffe4867ef1ed74f82f80119c1bdde16c996df2e2782df1b4c3de3ac67e49ce9f60
+  data.tar.gz: afdd185b69e7208bcc489c6f707c2d3c77a3a44447f27650db5f985958dd2856b7ce117a684ba2273639d469bf4c39d02a0abe523d7d943b22b1c438d3e076c6

data/.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1

data/.github/workflows/ruby.yml

@@ -8,7 +8,7 @@ jobs:
 
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -24,6 +24,7 @@ jobs:
       fail-fast: false
       matrix:
         ruby:
+          - '4.0'
           - 3.4
           - 3.3
           - 3.2
@@ -73,7 +74,7 @@ jobs:
 
     steps:
     - name: Check out repository code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## [v0.5.0](https://github.com/cedarcode/devise-webauthn/compare/v0.4.0...v0.5.0/) - 2026-07-13
+
+### Added
+
+- Submit WebAuthn forms with `requestSubmit` so Turbo can intercept. [#140](https://github.com/cedarcode/devise-webauthn/pull/140) [@santiagorodriguez96]
+
+### Changed
+
+- BREAKING!: The WebAuthn options endpoints (`passkey_registration_options`, `passkey_authentication_options`, `security_key_registration_options` and `security_key_authentication_options`) now respond to `POST` instead of `GET`, since they mutate server state (they store the WebAuthn challenge in the session). If you overrode any of these controllers, rename the overridden `index` action to `create`; if you copied the bundled JavaScript into your app, update your copy. [#147](https://github.com/cedarcode/devise-webauthn/pull/147)[@santiagorodriguez96]
+- BREAKING!: `webauthn_id` is now generated and persisted when WebAuthn registration options are requested, instead of eagerly in a `before_validation` callback, so backfilling existing records is no longer needed and the migration generated by `devise:webauthn:webauthn_id` no longer includes one. If your app relies on `webauthn_id` being set on create (e.g. you added a `NOT NULL` constraint to the column), add your own callback or database default, or drop the constraint. [#148](https://github.com/cedarcode/devise-webauthn/pull/148) [@santiagorodriguez96]
+
 ## [v0.4.0](https://github.com/cedarcode/devise-webauthn/compare/v0.3.1...v0.4.0/) - 2026-04-06
 
 ### Added

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    devise-webauthn (0.4.0)
+    devise-webauthn (0.5.0)
       devise (>= 4.9)
       webauthn (~> 3.0)
 

data/README.md

@@ -283,7 +283,7 @@ Used for registering new credentials (passkeys or security keys).
 
 ```html
 <form action="/passkeys" method="post">
-  <webauthn-create data-options-json="<%= create_passkey_options(@user).to_json %>">
+  <webauthn-create data-options-url="<%= passkey_registration_options_path(:user) %>">
     <input type="hidden" name="public_key_credential" data-webauthn-target="response">
     <input type="text" name="name" placeholder="Passkey name">
     <button type="submit">Create Passkey</button>
@@ -296,9 +296,11 @@ Used for registering new credentials (passkeys or security keys).
   - The form's action should point to the appropriate endpoint – you can use the provided url helpers:
     - For creating passkeys: `passkeys_path(resource_name)`
     - For creating 2FA security keys: `second_factor_webauthn_credentials_path(resource_name)`
-- Requires a `data-options-json` attribute containing JSON-serialized WebAuthn creation options
+- Requires a `data-options-url` attribute pointing to the endpoint serving the WebAuthn creation options – you can use the provided url helpers:
+  - For passkey creation options: `passkey_registration_options_path(resource_name)`
+  - For 2FA security key creation options: `security_key_registration_options_path(resource_name)`
 - Must contain a hidden input with `data-webauthn-target="response"` to store the credential response
-- Must contain the submit button — the element intercepts form submission, calls the WebAuthn API, stores the credential in the hidden input, and then re-submits the form
+- Must contain the submit button – the element intercepts form submission, fetches the options, calls the WebAuthn API, stores the credential in the hidden input, and then re-submits the form
 
 #### `<webauthn-get>`
 
@@ -306,7 +308,7 @@ Used for authenticating with existing credentials.
 
 ```html
 <form action="/users/sign_in" method="post">
-  <webauthn-get data-options-json="<%= passkey_authentication_options.to_json %>">
+  <webauthn-get data-options-url="<%= passkey_authentication_options_path(:user) %>">
     <input type="hidden" name="public_key_credential" data-webauthn-target="response">
     <button type="submit">Sign in with Passkey</button>
   </webauthn-get>
@@ -318,9 +320,11 @@ Used for authenticating with existing credentials.
     - The form's action should point to the appropriate endpoint – you can use the provided url helpers:
         - For passkey sign-in: `session_path(resource_name)`
         - For 2FA with WebAuthn: `two_factor_authentication_path(resource_name)`
-- Requires a `data-options-json` attribute containing JSON-serialized WebAuthn request options
+- Requires a `data-options-url` attribute pointing to the endpoint serving the WebAuthn request options – you can use the provided url helpers:
+  - For passkey authentication options: `passkey_authentication_options_path(resource_name)`
+  - For 2FA security key authentication options: `security_key_authentication_options_path(resource_name)`
 - Must contain a hidden input with `data-webauthn-target="response"` to store the credential response
-- Must contain the submit button — the element intercepts form submission, calls the WebAuthn API, stores the credential in the hidden input, and then re-submits the form
+- Must contain the submit button – the element intercepts form submission, fetches the options, calls the WebAuthn API, stores the credential in the hidden input, and then re-submits the form
 
 ## Development
 

data/app/assets/javascript/devise/webauthn.js

@@ -19,17 +19,21 @@ export class WebauthnCreateElement extends HTMLElement {
     }
 
     this.closest('form').addEventListener('submit', async (event) => {
+      if (this.dataset.ceremonyCompleted) return;
+
       event.preventDefault();
 
       try {
-        const response = await fetch(this.getAttribute('data-options-url'));
-        const publicKey = PublicKeyCredential.parseCreationOptionsFromJSON(await response.json());
+        const options = await fetchOptions(this.getAttribute('data-options-url'));
+        const publicKey = PublicKeyCredential.parseCreationOptionsFromJSON(options);
         const credential = await navigator.credentials.create({ publicKey });
 
         this.querySelector('[data-webauthn-target="response"]').value = await this.stringifyRegistrationCredentialWithGracefullyHandlingAuthenticatorIssues(credential);
 
-        this.closest('form').submit();
+        this.dataset.ceremonyCompleted = "true";
+        this.closest('form').requestSubmit();
       } catch (error) {
+        delete this.dataset.ceremonyCompleted;
         this.handleError(error);
       }
     });
@@ -100,17 +104,21 @@ export class WebauthnGetElement extends HTMLElement {
     }
 
     this.closest('form').addEventListener('submit', async (event) => {
+      if (this.dataset.ceremonyCompleted) return;
+
       event.preventDefault();
 
       try {
-        const response = await fetch(this.getAttribute('data-options-url'));
-        const publicKey = PublicKeyCredential.parseRequestOptionsFromJSON(await response.json());
+        const options = await fetchOptions(this.getAttribute('data-options-url'));
+        const publicKey = PublicKeyCredential.parseRequestOptionsFromJSON(options);
         const credential = await navigator.credentials.get({ publicKey });
 
         this.querySelector('[data-webauthn-target="response"]').value = await this.stringifyAuthenticationCredentialWithGracefullyHandlingAuthenticatorIssues(credential);
 
-        this.closest('form').submit();
+        this.dataset.ceremonyCompleted = "true";
+        this.closest('form').requestSubmit();
       } catch (error) {
+        delete this.dataset.ceremonyCompleted;
         this.handleError(error);
       }
     });
@@ -168,6 +176,19 @@ export class WebauthnGetElement extends HTMLElement {
   }
 }
 
+async function fetchOptions(url) {
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: { 'Accept': 'application/json' }
+  });
+
+  if (!response.ok) {
+    throw new Error(`Fetching WebAuthn options failed with status ${response.status}`);
+  }
+
+  return response.json();
+}
+
 function toBase64Url(buffer) {
   if (!buffer) return null;
 

data/app/controllers/devise/passkey_authentication_options_controller.rb

@@ -2,7 +2,9 @@
 
 module Devise
   class PasskeyAuthenticationOptionsController < DeviseController
-    def index
+    skip_forgery_protection
+
+    def create
       passkey_options =
         WebAuthn::Credential.options_for_get(
           user_verification: "required"

data/app/controllers/devise/passkey_registration_options_controller.rb

@@ -2,9 +2,12 @@
 
 module Devise
   class PasskeyRegistrationOptionsController < DeviseController
+    skip_forgery_protection
+
     before_action :authenticate_scope!
+    before_action :ensure_webauthn_id!
 
-    def index
+    def create
       passkey_options =
         WebAuthn::Credential.options_for_create(
           user: {
@@ -31,6 +34,10 @@ module Devise
       self.resource = send(:"current_#{resource_name}")
     end
 
+    def ensure_webauthn_id!
+      resource.ensure_webauthn_id!
+    end
+
     def resource_human_palatable_identifier
       authentication_keys = resource.class.authentication_keys
       authentication_keys = authentication_keys.keys if authentication_keys.is_a?(Hash)

data/app/controllers/devise/security_key_authentication_options_controller.rb

@@ -2,9 +2,11 @@
 
 module Devise
   class SecurityKeyAuthenticationOptionsController < DeviseController
+    skip_forgery_protection
+
     before_action :set_resource
 
-    def index
+    def create
       security_key_authentication_options =
         WebAuthn::Credential.options_for_get(
           allow: @resource.webauthn_credentials.pluck(:external_id),

data/app/controllers/devise/security_key_registration_options_controller.rb

@@ -2,9 +2,12 @@
 
 module Devise
   class SecurityKeyRegistrationOptionsController < DeviseController
+    skip_forgery_protection
+
     before_action :authenticate_scope!
+    before_action :ensure_webauthn_id!
 
-    def index
+    def create
       create_security_key_options =
         WebAuthn::Credential.options_for_create(
           user: {
@@ -31,6 +34,10 @@ module Devise
       self.resource = send(:"current_#{resource_name}")
     end
 
+    def ensure_webauthn_id!
+      resource.ensure_webauthn_id!
+    end
+
     def resource_human_palatable_identifier
       authentication_keys = resource.class.authentication_keys
       authentication_keys = authentication_keys.keys if authentication_keys.is_a?(Hash)

data/lib/devise/models/webauthn_credential_authenticatable.rb

@@ -11,10 +11,15 @@ module Devise
         has_many :webauthn_credentials, dependent: :destroy
 
         validates :webauthn_id, uniqueness: true, allow_blank: true
+      end
+
+      def ensure_webauthn_id!
+        return webauthn_id if webauthn_id.present?
+
+        self.webauthn_id = WebAuthn.generate_user_id
+        save!(validate: false)
 
-        before_validation do
-          self.webauthn_id ||= WebAuthn.generate_user_id
-        end
+        webauthn_id
       end
     end
   end

data/lib/devise/webauthn/routes.rb

@@ -8,9 +8,9 @@ module ActionDispatch
       def devise_passkey_authentication(_mapping, controllers)
         resources :passkeys, only: %i[new create destroy], controller: controllers[:passkeys]
 
-        resources :passkey_authentication_options, only: :index,
+        resources :passkey_authentication_options, only: :create,
                                                    controller: controllers[:passkey_authentication_options]
-        resources :passkey_registration_options, only: :index, controller: controllers[:passkey_registration_options]
+        resources :passkey_registration_options, only: :create, controller: controllers[:passkey_registration_options]
       end
 
       def devise_two_factor_authentication(_mapping, controllers)
@@ -22,9 +22,9 @@ module ActionDispatch
                   only: %i[new create update destroy],
                   controller: controllers[:second_factor_webauthn_credentials]
 
-        resources :security_key_authentication_options, only: %i[index],
+        resources :security_key_authentication_options, only: :create,
                                                         controller: controllers[:security_key_authentication_options]
-        resources :security_key_registration_options, only: %i[index],
+        resources :security_key_registration_options, only: :create,
                                                       controller: controllers[:security_key_registration_options]
       end
     end

data/lib/devise/webauthn/test/authenticator_helpers.rb

@@ -39,7 +39,7 @@ module Devise
             "privateKey" => encoded_private_key,
             "signCount" => 0
           }
-          credential_json["userHandle"] = resource.webauthn_id if passkey
+          credential_json["userHandle"] = resource.ensure_webauthn_id! if passkey
 
           authenticator.add_credential(credential_json)
 

data/lib/devise/webauthn/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module Webauthn
-    VERSION = "0.4.0"
+    VERSION = "0.5.0"
   end
 end

data/lib/generators/devise/webauthn/webauthn_id/webauthn_id_generator.rb

@@ -6,22 +6,17 @@ require "rails/generators/active_record"
 module Devise
   module Webauthn
     class WebauthnIdGenerator < Rails::Generators::Base
-      include Rails::Generators::Migration
-
       hide!
       namespace "devise:webauthn:webauthn_id"
 
-      source_root File.expand_path("templates", __dir__)
-
       desc "Add webauthn_id field to User model"
       class_option :resource_name, type: :string, default: "user", desc: "The resource name for Devise (default: user)"
 
-      def self.next_migration_number(dirname)
-        ActiveRecord::Generators::Base.next_migration_number(dirname)
-      end
-
       def generate_migration
-        migration_template "add_webauthn_id.rb.erb", "db/migrate/add_webauthn_id_to_#{user_table_name}.rb"
+        invoke "active_record:migration", [
+          "add_webauthn_id_to_#{user_table_name}",
+          "webauthn_id:string:uniq"
+        ]
       end
 
       def show_instructions

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-webauthn
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Cedarcode
@@ -111,7 +111,6 @@ files:
 - lib/generators/devise/webauthn/views_generator.rb
 - lib/generators/devise/webauthn/webauthn_credential_model/templates/webauthn_credential_migration.rb.erb
 - lib/generators/devise/webauthn/webauthn_credential_model/webauthn_credential_model_generator.rb
-- lib/generators/devise/webauthn/webauthn_id/templates/add_webauthn_id.rb.erb
 - lib/generators/devise/webauthn/webauthn_id/webauthn_id_generator.rb
 homepage: https://github.com/cedarcode/devise-webauthn
 licenses:

data/lib/generators/devise/webauthn/webauthn_id/templates/add_webauthn_id.rb.erb

@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-class AddWebauthnIdTo<%= user_table_name.camelize %> < ActiveRecord::Migration[<%= Rails.version.to_f %>]
-  def up
-    add_column :<%= user_table_name %>, :webauthn_id, :string
-    add_index :<%= user_table_name %>, :webauthn_id, unique: true
-
-    # WARNING: The code below backfills webauthn_id for all existing records
-    # one row at a time. For larger tables, consider removing it and running
-    # the backfill separately (e.g., in a background job or maintenance task).
-    #
-    # Worth noting: PostgreSQL and MySQL support single-query backfills:
-    #
-    #   PostgreSQL:
-    #     UPDATE <%= user_table_name %> SET webauthn_id = encode(gen_random_bytes(64), 'base64') WHERE webauthn_id IS NULL
-    #
-    #   MySQL:
-    #     UPDATE <%= user_table_name %> SET webauthn_id = TO_BASE64(RANDOM_BYTES(64)) WHERE webauthn_id IS NULL
-    #
-    execute("SELECT id FROM <%= user_table_name %> WHERE webauthn_id IS NULL").each do |row|
-      webauthn_id = WebAuthn.generate_user_id
-      execute(ActiveRecord::Base.sanitize_sql_array(
-        ["UPDATE <%= user_table_name %> SET webauthn_id = ? WHERE id = ?", webauthn_id, row["id"]]
-      ))
-    end
-    # Note: if your application creates records using methods that skip
-    # callbacks (e.g., insert_all), consider adding a database default
-    # to ensure webauthn_id is always set. For example, in PostgreSQL:
-    #
-    #   change_column_default :<%= user_table_name %>, :webauthn_id, from: nil, to: -> { "encode(gen_random_bytes(64), 'base64')" }
-    #
-    # For the same reason, you may want to add a NOT NULL constraint in a
-    # separate migration after the backfill is complete:
-    #
-    #   change_column_null :<%= user_table_name %>, :webauthn_id, false
-  end
-
-  def down
-    remove_column :<%= user_table_name %>, :webauthn_id
-  end
-end