feat: add configurable challenge store for WebAuthn challenges by RenzoMinelli · Pull Request #150 · cedarcode/devise-webauthn

RenzoMinelli · 2026-09-25T15:27:13Z

What: Adds Devise::Webauthn.challenge_store so WebAuthn challenges can be kept somewhere other than the session. The default session store keeps today's keys and behaviour.

Why: This is the first step toward passkey sign-in from API clients such as React Native with devise-jwt, which have no cookie session. A cache-backed store follows in the next PR.

How to test: bundle exec rspec. passkey_authentication_spec.rb signs in through MemoryChallengeStore, a store that doesn't use the session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Controllers and strategies now read and write challenges through `Devise::Webauthn.challenge_store`. The default session store keeps the existing session keys, so behaviour is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Controllers and strategies include `Devise::Webauthn::ChallengeStoreAccess` instead of calling `Devise::Webauthn.challenge_store_for(request)`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The challenge is consumed inside `verify_and_save_*`, which is skipped when parsing the credential raises or when an app overrides it. The `ensure` restores the previous guarantee that the challenge is always cleared. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

santiagorodriguez96

Looking really good!!!

santiagorodriguez96 · 2026-10-02T20:59:51Z

+          @session[KEYS.fetch(purpose)] = challenge
+        end
+
+        def pending?(purpose, _credential_json)


Why the _credential_json param if we are not going to use it?

The store interface needs it. ChallengeStores::Cache in #152 has no session, so it reads the challenge from the credential's clientDataJSON to build the key. I renamed it to _credential to match #152.

Hmmmm I see...

In that case I think I would hold off these changes and instead include them in #152 as I think they can be confusing here. I think that would give clarity about what we are including those params in this methods. What's more, I'd be able to explore different approaches and discuss them in that PR to avoid having to do that.

What do you think?

Agreed. Removed in 46aaa6c; the argument comes back in #152 with the Cache store.

Rename the verified challenge to expected_challenge and the unused store argument to _credential. Move the custom store specs into the passkey authentication spec and extract MemoryChallengeStore to spec/support. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

santiagorodriguez96 · 2026-10-06T20:28:47Z

+          @session[KEYS.fetch(purpose)] = challenge
+        end
+
+        def pending?(purpose, _credential_json)


Hmmmm I see...

In that case I think I would hold off these changes and instead include them in #152 as I think they can be confusing here. I think that would give clarity about what we are including those params in this methods. What's more, I'd be able to explore different approaches and discuss them in that PR to avoid having to do that.

What do you think?

santiagorodriguez96 · 2026-10-06T21:29:22Z

    end
  end
+
+  describe "sign-in with passkeys through a custom challenge store" do


I've been thinking about the new sign-in with passkeys through a custom challenge store block, and I wonder if we could fold it into the existing specs 🤔

The existing specs still pass, but only because :session is the default. They read session directly, so they test the session store's internals, not the challenge store interface.

What if we merge the new block with the existing examples, like this?

Set the specs to use MemoryChallengeStore explicitly, so nothing passes just because of the default store.

Check challenges through challenge_store instead of the session

Done in 46aaa6c. The passkey authentication examples now run against MemoryChallengeStore and read challenges through the store.

…face Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

santiagorodriguez96

Overall looks good to me!

Let's keep iterating over this 🙂

santiagorodriguez96 · 2026-10-07T20:56:30Z

Isn't this a model spec? Should we move it to our models/ folder?

Now that I think about it tho, shouldn't it be placed in spec/models? Not to be done as part of this PR but just to spark the discussion :)

These aren't models, they're plain Ruby classes. Specs here mirror lib/ (spec/devise/webauthn/ ↔ lib/devise/webauthn/, spec/devise/models/ ↔ lib/devise/models/), so I'd leave them. Happy to discuss a different layout in a separate PR.

santiagorodriguez96 · 2026-10-07T20:56:34Z

These aren't models, they're plain Ruby classes. Specs here mirror lib/ (spec/devise/webauthn/ ↔ lib/devise/webauthn/, spec/devise/models/ ↔ lib/devise/models/), so I'd leave them. Happy to discuss a different layout in a separate PR.

…request Stores already receive the request, so callers no longer pass the credential and the store interface stays as merged in #150. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link challenge store entries to #150

e4e111b

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link challenge store entries to #150

8b7958b

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--challenge-store branch from e4e111b to 8b7958b Compare September 25, 2026 15:27

RenzoMinelli marked this pull request as draft September 25, 2026 15:29

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link challenge store entries to #150

4c0251a

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--challenge-store branch from f59cbd8 to 3de9e63 Compare September 25, 2026 18:33

RenzoMinelli changed the base branch from master to rm--pin-json-for-rails-7 September 25, 2026 18:33

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link challenge store entries to #150

9c359ff

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--challenge-store branch from c41508e to 77331d8 Compare September 25, 2026 19:06

RenzoMinelli changed the base branch from rm--pin-json-for-rails-7 to rm--retry-detached-node-errors September 25, 2026 19:06

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link challenge store entries to #150

676fe85

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--challenge-store branch from 77331d8 to a541487 Compare September 25, 2026 19:23

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link challenge store entries to #150

b7bd643

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--challenge-store branch from a541487 to 176c904 Compare September 25, 2026 19:52

Base automatically changed from rm--retry-detached-node-errors to master September 25, 2026 20:31

RenzoMinelli and others added 4 commits September 25, 2026 17:32

docs(CHANGELOG): link challenge store entries to #150

2937591

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

refactor: expose the challenge store through a challenge_store method

936fbca

Controllers and strategies include `Devise::Webauthn::ChallengeStoreAccess` instead of calling `Devise::Webauthn.challenge_store_for(request)`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--challenge-store branch from 176c904 to 05e8ad1 Compare September 25, 2026 20:32

RenzoMinelli marked this pull request as ready for review September 25, 2026 20:34

RenzoMinelli added this pull request to stack #156 October 2, 2026 20:17

santiagorodriguez96 reviewed Oct 2, 2026

View reviewed changes

RenzoMinelli and others added 2 commits October 2, 2026 19:00

refactor: select the challenge store with a symbol

316a49f

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

RenzoMinelli requested a review from santiagorodriguez96 October 6, 2026 12:37

santiagorodriguez96 reviewed Oct 6, 2026

View reviewed changes

refactor: drop the credential argument from the challenge store inter…

46aaa6c

…face Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

santiagorodriguez96 approved these changes Oct 7, 2026

View reviewed changes

RenzoMinelli merged commit 796cf2b into master Oct 7, 2026
31 checks passed

RenzoMinelli deleted the rm--challenge-store branch October 7, 2026 21:15

RenzoMinelli mentioned this pull request Oct 7, 2026

feat: add a cache challenge store for API clients without a session #152

Open

Conversation

RenzoMinelli commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

santiagorodriguez96 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

santiagorodriguez96 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

RenzoMinelli commented Sep 25, 2026 •

edited

Loading