Problem with 2factor plugin and webauthn

[FrankM]

@julian Nice feature, but i got 'id and credid were the same'

I am using 1.18.6, nodebb-plugin-2factor is 3.0.2

My yubico key works on yubico test site

[julian]

Hi @frankm -- thanks for reporting... regarding the error message: "were the same" or not the same?

This is significant because id and credId are supposed to be the same @yLothar helped me work through an issue where they were not the same, and that was fixed in v3.0.3 of the plugin.

Edit: I took a closer look at your post, and you are using the funky (not in a good way) v3.0.2 version. Please upgrade to v3.0.4

[FrankM]

@julian

After testing 3.0.2 and seeing the error message, I discovered version 3.04 and updated the plugin. I could then register the key, baer after logging out and logging in again nothing worked.....

A search revealed that the forum stopped working because of an error message....

The only possibility was now the following

./nodebb reset -p nodebb-plugin-2factor

Suggested solution?

2022-01-11T15:55:29.071Z [4568/85668] - error: [plugins] Error executing 'static:sockets.validateSession' in plugin 'nodebb-plugin-2factor'
Error: [[2factor:second-factor-required]]
    at plugin.checkSocket (/home/user_radforum/nodebb/node_modules/nodebb-plugin-2factor/library.js:323:9)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    [..shortened..]

[julian]

@frankm That error shouldn't crash NodeBB. What do you mean when you say "nothing happens"?

[FrankM]

@julian Forum down and forum constantly restarts and crashes.

[julian]

@frankm I believe this is fixed in master

https://github.com/NodeBB/NodeBB/commit/fa01801f645ea980f34a73eed5fb6596c80d1e57#diff-b80b656e3a5aab4f2f91937701c22e8fa18cc98ee7515a225114605113a94004

It's specifically an issue with Node v16... downgrading to v14 should fix the issue for now.

0 julianlam committed to NodeBB/NodeBB

fix: don't throw on invalid session, just return early so socket is not opened.

Also updated the plugin hook call to `static:sockets.validateSession` to not return a result, because in static calls that result is always null anyway

[FrankM]

@julian It works

Using fix from master -> https://github.com/NodeBB/NodeBB/commit/fa01801f645ea980f34a73eed5fb6596c80d1e57#diff-b80b656e3a5aab4f2f91937701c22e8fa18cc98ee7515a225114605113a94004

Thanks!

0 julianlam committed to NodeBB/NodeBB

fix: don't throw on invalid session, just return early so socket is not opened.

Also updated the plugin hook call to `static:sockets.validateSession` to not return a result, because in static calls that result is always null anyway