sneak/quak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Green: treat empty-string 2FA session fields as absent

Browse Source 
Use || instead of ?? when picking the TOTP session ID. The server
sends "" for unset 2FA fields (no omitempty), and "" ?? v2
short-circuits to "", which made dual-2FA accounts fall through to
the unsupported passkey branch.
This commit is contained in:
Jeffrey Paul
2026-06-10 11:26:15 -07:00
parent 2c51074294
commit 68d8cfb7fe
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/auth/login.ts
View File

@@ -76,8 +76,12 @@ const srpHandshake = async (
// twoFactorSessionIDV2 is set (instead of twoFactorSessionID) when the // twoFactorSessionIDV2 is set (instead of twoFactorSessionID) when the
// account has BOTH passkeys and TOTP. Prefer TOTP: a CLI cannot perform // account has BOTH passkeys and TOTP. Prefer TOTP: a CLI cannot perform
// a WebAuthn ceremony, and the user has a TOTP secret enrolled. // a WebAuthn ceremony, and the user has a TOTP secret enrolled.
//
// The server marshals these fields without `omitempty`, so unset fields
// arrive as "" rather than being absent. Use || (not ??) so empty
// strings are treated as not-set.
const totpSessionID = const totpSessionID =
verifyResponse.twoFactorSessionID ?? verifyResponse.twoFactorSessionID ||
verifyResponse.twoFactorSessionIDV2; verifyResponse.twoFactorSessionIDV2;
if (totpSessionID) { if (totpSessionID) {
return { kind: "totp", sessionID: totpSessionID }; return { kind: "totp", sessionID: totpSessionID };