Wrap WebAuthn library errors and log their category server-side

[KaveeshaPiumini]

Purpose

Keep library-specific details generated by the underlying go-webauthn library from reaching external clients, while making WebAuthn verification failures debuggable server-side. Refs #1647.

The passkey service already returned generic internal PSK codes to clients for verification failures (no library string ever reached a client). What was missing was structured, debuggable server-side detail about why the library rejected a ceremony.

Approach

• Added a small webAuthnErrorFields(err) helper in webauthn_service.go (the layer that already abstracts the WebAuthn library, so library-specific knowledge stays in one place). When the error is a protocol.Error it logs the category, detail and debug info as separate fields (recognized through wrapped errors via errors.As); otherwise it logs the plain message.
• Used it at the three library verification sites (CreateCredential, ValidateLogin, ValidatePasskeyLogin), which continue to return the existing generic PSK codes to clients.
• Added unit tests for the helper.

Why not a per-category error taxonomy? An earlier revision mapped each library error category to a distinct client-facing code. That was dropped deliberately: exposing exactly why an authentication ceremony failed (challenge vs. signature vs. origin) is a verification oracle, and hardened WebAuthn implementations return a single generic failure to the client with the specifics kept in server logs. This revision does exactly that, with far less code and no new API surface.

Evidence (local)

Real registration verification failure (origin mismatch fixture):

level=ERROR msg="Failed to verify and create credential" component=PasskeyService \
  webAuthnErrorType=verification_error \
  webAuthnErrorDetail="Error validating origin" \
  webAuthnErrorDebug="Expected Values: [https://localhost:8090], Received: https://webauthn.io"

The caller receives generic PSK-1011 (invalid attestation response); no library detail is exposed. All passkey/authn/flow tests pass, golangci-lint reports 0 issues, i18n catalog unchanged from baseline.

Related Issues

• Wrap WebAuthn Library Errors into Internal System Error Codes #1647

Checklist

• Followed the contribution guidelines.
• Tests provided.
  • Unit Tests (webauthn_error_fields_test.go; existing service_test.go covers real library failures returning generic codes)
• Breaking changes. (Not applicable)

Security checks

• Followed secure coding standards (generic client errors avoid a verification oracle; specifics logged server-side only).
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 607e7b69-6d7b-4f15-9693-f5da5019f01f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}