- Shipped
- 15 листопада 2026 р. о 04:50 UTC
- Author
- Kamo
- Commit
- f04e606
Passkeys (Yubico java-webauthn-server 2.6.0): register/options|verify (***), auth/options|verify (public, discoverable only - allowCredentials always empty), GET/PATCH/DELETE /api/security/passkeys. RP ID = parent of the ceremony host (login.acme.com -> acme.com), stored in user_passkeys.rp_id; residentKey + userVerification REQUIRED so a passkey IS the second factor; challenges single-use (PKREG/PKAUTH GETDEL, 5 min); a signature counter going backwards = PASSKEY_SUSPECT (audited HIGH, row kept). PASSKEY_ADDED/REMOVED + letters, LOGIN_PASSKEY. Emailed code (org email_code_enabled): signin/email-code/send|verify - same answer for every identifier, letter sent async only for a real account an allowing org can admit, 6 digits, 10 min, 5 tries, put back on our own fault. One factor; LOGIN_EMAIL_CODE. Trusted browser (org trusted_device_days): mfa/challenge rememberDevice -> trustedDeviceToken; the X-Kamo-Trusted-Device header skips ONLY the authenticator step (password login + SignInCompletion); forgotten on any password change and sign-out-everywhere. KamoMobile approval: **************** number matching (2 digits on the computer, 3 choices on the phone, one wrong pick denies), 2 min, pushed as SIGNIN_APPROVAL via MediaService; QR: signin/qr/start|status + device qr-preview|qr-approve, session lands in the org the phone chose. Device endpoints authenticated by X-Kamo-Device-Token (validated, not rotated). signin/methods now answers **************** from policy + kill switches. **************** runs every downstream gate (account, workspace, the method's org switch, access rules, SignInCompletionService). Password path unchanged unless a trusted-device header is sent.