Repair WebAuthn Challenge Flow Bugs

The problem

WebAuthn and passkey implementations often suffer from race conditions, inconsistent state ownership between registration and authentication, or broken cleanup logic during timeouts. These bugs lead to sporadic authentication failures that are difficult to reproduce and debug in local environments.

What it does

• Identifies and patches inconsistencies in WebAuthn challenge generation, storage, and one-time consumption logic.
• Enforces strict RP ID and origin policy boundaries across parsing and validation layers.
• Corrects sign-counter policy drift and credential-to-user binding defects.
• Implements deterministic local fixtures and byte-level test barriers to replicate edge cases.
• Aligns retries, cancellation, and observability without leaking customer secrets or PII.

Frameworks & tools

Works with any stack using WebAuthn/FIDO2 standards. Analyzes repository files via Read, Edit, and Bash.

Why this beats prompting it yourself

Generic prompts often suggest weakening security policies or using broad retries to "fix" flaky tests. This skill enforces transaction integrity and strictly preserves attestation and timeout policies while ensuring validation happens before irreversible state mutations.

Use cases

• Fixing concurrent tab conflicts where one session invalidates another's passkey challenge.
• Repairing sign-counter synchronization issues between the authenticator and the backend.
• Hardening registration flows to prevent partial state creation on failed attestation.
• Adding redacted observability to track passkey failures without logging sensitive credentials.

Known limitations

Cannot contact production services or access live customer data. Requires local repository access and operates through disposable fixtures rather than live hardware authenticators.