{"record":{"id":"15d7a490a8f453b7","repo":"nextauthjs/next-auth","slug":"webauthn-challenge-was-missing","errorCode":null,"errorMessage":"WebAuthn challenge was missing","messagePattern":"WebAuthn challenge was missing","errorType":"exception","errorClass":"InvalidCheck","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/oauth/checks.ts","lineNumber":270,"sourceCode":"  async use(\n    options: InternalOptions<WebAuthnProviderType>,\n    cookies: RequestInternal[\"cookies\"],\n    resCookies: Cookie[]\n  ): Promise<WebAuthnChallengePayload> {\n    const cookieValue = cookies?.[options.cookies.webauthnChallenge.name]\n\n    const parsed = await parseCookie(\"webauthnChallenge\", cookieValue, options)\n\n    const payload = await decode<WebAuthnChallengePayload>({\n      secret: options.jwt.secret,\n      token: parsed,\n      salt: webauthnChallengeSalt,\n    })\n\n    // Clear the WebAuthn challenge cookie after use\n    clearCookie(\"webauthnChallenge\", options, resCookies)\n\n    if (!payload) throw new InvalidCheck(\"WebAuthn challenge was missing\")\n\n    return payload\n  },\n}\n","sourceCodeStart":252,"sourceCodeEnd":275,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/oauth/checks.ts#L252-L275","documentation":"The WebAuthn check's `use` throws InvalidCheck(\"WebAuthn challenge was missing\") when decoding the webauthnChallenge cookie at the callback/verification step yields no payload. The challenge is stored in a cookie when the WebAuthn flow starts and must be present to verify the authenticator's response.","triggerScenarios":"During WebAuthn sign-in or registration verification, the webauthnChallenge cookie is absent or undecodable (decode returns falsy payload) when use() runs after clearing the cookie. Commonly caused by the browser not storing/sending the cookie between the challenge request and the authenticate response.","commonSituations":"Cross-site (Safari/ITP) or third-party cookie blocking dropping the challenge cookie; API clients (mobile apps, fetch without credentials: 'include') that don't persist cookies; AUTH_URL/origin mismatch invalidating Secure cookies; challenge issued on a different domain than verification.","solutions":["Ensure the client sends credentials with every Auth.js request (fetch with credentials: \"include\" / axios withCredentials).","Verify cookies survive in the target browser; test outside private mode and check SameSite/Secure settings relative to AUTH_URL.","Make sure the WebAuthn challenge and verification hit the same origin/host configured in AUTH_URL.","If building a native client, implement a cookie jar that persists the webauthnChallenge cookie across the two requests.","Restart the WebAuthn flow to obtain a fresh challenge."],"exampleFix":"// before: fetch drops cookies\nawait fetch(\"/api/auth/callback/webauthn\", { method: \"POST\", body })\n// after\nawait fetch(\"/api/auth/callback/webauthn\", {\n  method: \"POST\",\n  body,\n  credentials: \"include\",\n})","handlingStrategy":"validation","validationCode":"// client-side: ensure cookies are sent with every auth request\nconst res = await fetch(\"/api/auth/session\", { credentials: \"include\" })\nif (!res.headers.get(\"set-cookie\") && !document.cookie.includes(\"webauthnChallenge\")) {\n  console.warn(\"Challenge cookie may not persist; check SameSite/credentials\")\n}","typeGuard":null,"tryCatchPattern":"try {\n  await signIn(\"webauthn\", { challenge })\n} catch (e) {\n  if (e?.message?.includes(\"WebAuthn challenge was missing\")) {\n    // restart the WebAuthn flow to get a fresh challenge cookie\n  }\n}","preventionTips":["Send credentials: \"include\" on all auth fetch calls","Test passkey flows in Safari/ITP browsers where cookies are partitioned","For native/mobile clients, persist the challenge cookie in a cookie jar","Keep the challenge and verification requests on the same origin as AUTH_URL"],"tags":["webauthn","cookies","challenge","passkeys"],"backgroundTag":"webauthn-challenge-cookie-missing","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}