Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Successfully pushed a gem using webauthn authentication, even though the webpage authentication failed #4317

Open
postmodern opened this issue Dec 28, 2023 · 0 comments
Labels

Comments

@postmodern
Copy link
Contributor

postmodern commented Dec 28, 2023

I just successfully pushed ronin-support-1.0.5 to rubygems.org. I was prompted to authenticate my device using the WebAuthN URL. I visited the URL in my web browser (Chrome). The webpage prompted me to tap by 2FA device (a YubiKey) which I already have configured with rubygems.org and have successfully used it to generate 2FA/OTP codes. However, rubygems.org redirected me to https://rubygems.org/webauthn_verification/failed_verification?error=Failed+to+fetch claiming it failed to authenticate my device, but the output of gem push said that it successfully pushed the gem.

gem push output

Pushing gem to https://rubygems.org...
You have enabled multi-factor authentication. Please visit https://rubygems.org/webauthn_verification/XXXXXXXXXXX?port=NNNNN to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option.
You are verified with a security device. You may close the browser window.
Successfully registered gem: ronin-support (1.0.5)

Screenshot

rubygems org_webauthn_verification_failed_verification_error=Failed+to+fetch

Version Information

  • ruby 3.3.0 (2023-12-25 revision 5124f9ac75) [x86_64-linux]
  • rubygems 3.5.3
@postmodern postmodern added the bug label Dec 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant