{"record":{"id":"1af5ae22051b6782","repo":"quarkusio/quarkus","slug":"login-path-is-missing","errorCode":null,"errorMessage":"Login path is missing!","messagePattern":"Login path is missing!","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"extensions/security-webauthn/runtime/src/main/resources/webauthn.js","lineNumber":191,"sourceCode":"          headers: {\n            'Accept': 'application/json',\n            'Content-Type': 'application/json'\n          },\n          body: JSON.stringify(body)\n        })\n      })\n      .then(res => {\n        if (res.status >= 200 && res.status < 300) {\n          return res;\n        }\n        throw new Error(res.statusText, {cause: res});\n      });\n  };\n\n  WebAuthn.prototype.login = function (user) {\n    const self = this;\n\tif (!self.loginPath) {\n\t  throw new Error('Login path is missing!');\n\t}\n    return self.loginClientSteps(user)\n      .then(body => {\n        return self.fetchWithCsrf(self.loginPath, {\n          method: 'POST',\n          headers: {\n            'Accept': 'application/json',\n            'Content-Type': 'application/json'\n          },\n          body: JSON.stringify(body),\n        })\n      })\n      .then(res => {\n        if (res.status >= 200 && res.status < 300) {\n          return res;\n        }\n        throw new Error(res.statusText, {cause: res});\n      });","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security-webauthn/runtime/src/main/resources/webauthn.js#L173-L209","documentation":"webauthn.js's login() method requires the WebAuthn object to have a loginPath configured (where the assertion result is POSTed). Missing it throws a synchronous Error before the authentication ceremony starts.","triggerScenarios":"Calling webauthn.login(user) when webauthn.loginPath was never set on the instance (or not provided by the server-generated configuration).","commonSituations":"Client init code only sets registerPath; server did not expose the login endpoint path to the page; refactored pages where login handling was added without updating the JS bootstrap.","solutions":["Set webauthn.loginPath = '/q/webauthn/login' (or your configured endpoint) before calling login()","Ensure the page's server-side template/config injects the login path into the WebAuthn JS object","Add a check in your page code that the path properties are set before wiring event handlers"],"exampleFix":"// before\nconst webauthn = new WebAuthn();\nwebauthn.login(user);\n// after\nconst webauthn = new WebAuthn();\nwebauthn.loginPath = '/q/webauthn/login';\nwebauthn.login(user);","handlingStrategy":"validation","validationCode":"if (!webauthn.loginPath) {\n  throw new Error('webauthn.loginPath must be set before calling login()');\n}\nreturn webauthn.login(user);","typeGuard":"function canLogin(w) { return typeof w.loginPath === 'string' && w.loginPath.length > 0; }","tryCatchPattern":"try {\n  webauthn.login(user);\n} catch (e) {\n  if (e.message.includes('Login path is missing')) {\n    webauthn.loginPath = '/q/webauthn/login';\n    webauthn.login(user);\n  } else throw e;\n}","preventionTips":["Set both loginPath and registerPath in the shared WebAuthn bootstrap","Only call login() on pages where the login endpoint is configured","Unit-check the initialization module during refactors"],"tags":["webauthn","javascript","configuration","browser"],"backgroundTag":"missing-config-value","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}