From fe003b927ce7772692439992860c804de89ce424 Mon Sep 17 00:00:00 2001 From: Elias Schneider Date: Wed, 20 Aug 2025 15:49:09 +0200 Subject: [PATCH] fix: delete webauthn session after login to prevent replay attacks --- backend/internal/service/webauthn_service.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/backend/internal/service/webauthn_service.go b/backend/internal/service/webauthn_service.go index e6f26e71..f6fd742a 100644 --- a/backend/internal/service/webauthn_service.go +++ b/backend/internal/service/webauthn_service.go @@ -221,13 +221,15 @@ func (s *WebAuthnService) VerifyLogin(ctx context.Context, sessionID string, cre tx.Rollback() }() + // Load & delete the session row var storedSession model.WebauthnSession err := tx. WithContext(ctx). - First(&storedSession, "id = ?", sessionID). + Clauses(clause.Returning{}). + Delete(&storedSession, "id = ?", sessionID). Error if err != nil { - return model.User{}, "", err + return model.User{}, "", fmt.Errorf("failed to load WebAuthn session: %w", err) } session := webauthn.SessionData{ @@ -261,13 +263,13 @@ func (s *WebAuthnService) VerifyLogin(ctx context.Context, sessionID string, cre return model.User{}, "", err } - s.auditLogService.CreateNewSignInWithEmail(ctx, ipAddress, userAgent, user.ID, tx) - err = tx.Commit().Error if err != nil { return model.User{}, "", err } + s.auditLogService.CreateNewSignInWithEmail(ctx, ipAddress, userAgent, user.ID, tx) + return *user, token, nil }