XF 2.3 Passkey Issues

JonathanC

JonathanC

Active member
Hello,

I've been working on setting up a passkey on my 2.3 live site, and I keep getting this error. ( Using Yubikey 5C )

1723662596519.webp

I've disabled all my Add-ons, Disabled Cloudflare, and reverted back to the Default Style.... nothing has seemed to work.

I am not getting any errors in the admin panel, or on my webserver. I installed a fresh copy of Xenforo on a sub-domain hosted on the same server, and Passkey works without any issues. Does anyone have any suggestions to get this working on my live site? I've spent hours trying to make it work, and have gotten no where.
 
Last edited:
Sort by date Sort by votes
Maybe this...
Sim

Thread 'Login via "Passkey" created on Yubikey 5 does not work'

After setting up my 3 YubiKey devices as 2FA options on xenforo.com/community, none of them are working.

I get to the point of it asking for my PIN but then I get an error:

1711747763653.webp

The same error occurs with all 3 devices.

I can log in using a passkey with 1Password or with Windows Hello, but none of my yubikeys are recognised.

I tried deleting and then re-adding the passkey, but I get the same result.
  • Like
 
Upvote 0 Downvote
What do you mean by "Cloudflare Protection" exactly? If you are talking about the Cloudflare Security Level setting, unless you have a very specific reason that's unique to you, it should be Essentially Off. It's a terribly labeled setting... it doesn't make your site more (or less) secure, it should be labeled, "How annoying do you want to be to your users by making them solve captchas?" If you have it cranked up and one of the captcha solves needs to happen for a JavaScript request, it will be as if the JavaScript doesn't load (since it's not... until the user solves it, but they never see it since it's on a JavaScript request).
 
Upvote 0 Downvote
digitalpoint said:
What do you mean by "Cloudflare Protection" exactly? If you are talking about the Cloudflare Security Level setting, unless you have a very specific reason that's unique to you, it should be Essentially Off. It's a terribly labeled setting... it doesn't make your site more (or less) secure, it should be labeled, "How annoying do you want to be to your users by making them solve captchas?" If you have it cranked up and one of the captcha solves needs to happen for a JavaScript request, it will be as if the JavaScript doesn't load (since it's not... until the user solves it, but they never see it since it's on a JavaScript request).
Click to expand...
Bad choice of words on my end, I just pressed the Pause button within the Cloudflare Panel.
1723739689689.webp
 
Upvote 0 Downvote
Check your "Security Level" on the Cloudflare zone.

1723740017908.webp

95% chance that's your issue... and Cloudflare is issuing a captcha on the JavaScript request... user can't see it (or solve it), so the required Passkey JS never gets loaded.
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

Ferdinand
Passkey/biometric login doesn’t work on all pages
Replies
2
Views
39
Ferdinand
Ferdinand
danger@
Passkey registration failed: invalid rpId hash
Replies
0
Views
32
danger@
danger@
Sim
Fixed Cannot create Windows Hello passkey
Replies
6
Views
361
Sim
Sim
Sim
Cannot log in to xenforo.com using 3rd party passkey on Android 13
Replies
2
Views
139
Kirby
K
O
  • Solved
XF 2.3 Connecting with passkey but...
Replies
1
Views
45
Old Nick
O
Back
Top Bottom