callback_sessions_controller.rb

sessions_controller.rb

def callback
  webauthn_credential = WebAuthn::Credential.from_get(params)
  user = User.find_by(username: session["current_authentication"]["username"])
  raise "user #{session["current_authentication"]["username"]} never initiated sign up" unless user

  credential = user.credentials.find_by(external_id: Base64.strict_encode64(webauthn_credential.raw_id))
  
  begin
    webauthn_credential.verify(
      session["current_authentication"]["challenge"],
      public_key: credential.public_key,
      sign_count: credential.sign_count
    )

    credential.update!(sign_count: webauthn_credential.sign_count)
    sign_in(user)

    render json: { status: "ok" }, status: :ok
  rescue WebAuthn::Error => e
    render json: "Verification failed: #{e.message}", status: :unprocessable_entity
  ensure
    session.delete("current_authentication")
  end
end