issue with webauthn_verify_attestation_response in ios

[brijvaailen]

Hello Team,

I'm testing the Flow API for registration on native ios, I’ve set up the Hanko server locally and exposed the backend port using ngrok. I also added the iosappid under:

yaml

webauthn:
  relying_party:
    origins:
      - "http://localhost:8888"
      - "iosAppID:*****.passkey"

The registration flow completes successfully until the final step, webauthn_verify_attestation_response, which consistently returns a 500.

Request (cURL)

curl --location 'https://e016-14-98-189-6.ngrok-free.app/registration?action=webauthn_verify_attestation_response%40525a5c2e-15e7-4e90-9230-f0311dce5cb1' \
--header 'Content-Type: application/json' \
--header 'Cookie: hanko=...' \
--data '{ "input_data": { "public_key": { ... } }, "csrf_token": "qZ8sJc0fzmOQmTcVuQocoE1gxyy4DfEz" }'

Note:
I'm executing all steps via Postman. After receiving the public key in webauthn_generate_creation_options, I use that value to get the PublicKeyCredentialAttestationResponse from the mobile app and pass it to webauthn_verify_attestation_response via Postman.

Any insights on why the passkey might be considered invalid?

[FreddyDevelop]

Since you are running the Hanko backend on your local machine you should see an error in the backend logs. It should look something like this:

{"level":"info","time_unix":"1741169623","id":"oyXrsoHoPHJuwOrtvTghqKYQCLqBexLU","remote_ip":"192.168.65.1","host":"localhost:8000","method":"POST","uri":"/login?action=webauthn_verify_attestation_response%402a4a9389-4151-4adb-83e3-4291e4b5e41a","user_agent":"PostmanRuntime/7.42.0","status":500,"referer":"","error":"technical_error","error_internal":"the action failed to handle the request: failed to verify attestation response: failed to parse credential creation response; Error parsing attestation response","time":"2025-03-05T10:13:43.234286248Z"}

The log message should state what went wrong.