{"record":{"id":"6c598abfd7895959","repo":"zeroclaw-labs/zeroclaw","slug":"credential-id-too-long-bytes-max-max-credent","errorCode":null,"errorMessage":"Credential ID too long ({} bytes, max {MAX_CREDENTIAL_ID_LEN})","messagePattern":"Credential ID too long \\((.+?) bytes, max (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":400,"severity":"error","filePath":"crates/zeroclaw-runtime/src/security/webauthn.rs","lineNumber":312,"sourceCode":"        );\n\n        // 2. Parse attestation object to extract public key and auth data\n        let attestation_bytes = URL_SAFE_NO_PAD\n            .decode(&response.attestation_object)\n            .context(\"Invalid base64url in attestation_object\")?;\n\n        // For \"none\" attestation, we extract the authData which contains the\n        // credential public key. The attestation object is CBOR-encoded but\n        // for our minimal implementation we accept a simplified JSON format\n        // from our enrollment UI, or parse the raw CBOR authData.\n        let (public_key_bytes, sign_count) =\n            extract_public_key_from_attestation(&attestation_bytes)?;\n\n        // 3. Validate credential ID length\n        let cred_id_bytes = URL_SAFE_NO_PAD\n            .decode(&response.id)\n            .context(\"Invalid base64url in credential ID\")?;\n        anyhow::ensure!(\n            cred_id_bytes.len() <= MAX_CREDENTIAL_ID_LEN,\n            \"Credential ID too long ({} bytes, max {MAX_CREDENTIAL_ID_LEN})\",\n            cred_id_bytes.len()\n        );\n\n        let now = chrono::Utc::now().to_rfc3339();\n        let label = response\n            .label\n            .clone()\n            .unwrap_or_else(|| \"Hardware Key\".into());\n\n        let credential = WebAuthnCredential {\n            credential_id: response.id.clone(),\n            public_key: URL_SAFE_NO_PAD.encode(&public_key_bytes),\n            sign_count,\n            label,\n            registered_at: now,\n            algorithm: COSE_ALG_ES256,","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/webauthn.rs#L294-L330","documentation":"finish_registration base64url-decodes the credential ID and enforces the WebAuthn spec limit: at most MAX_CREDENTIAL_ID_LEN (1024) bytes. Longer IDs indicate a non-compliant or malicious authenticator, or a client that mangled the field, and are rejected.","triggerScenarios":"A non-compliant security key or platform authenticator emitting an oversized ID; a test client sending the raw bytes or the wrong field instead of base64url of the ID; concatenated/modified ID values produced by a client-side wrapper.","commonSituations":"Exotic or buggy authenticators during QA; custom client implementations serializing the wrong property; fuzzing payloads against the register endpoint.","solutions":["Reproduce with a mainstream browser and built-in passkey support to confirm the authenticator is at fault","Check the client sends response.id as the base64url encoding of the raw credential ID and nothing else","Treat authenticators that exceed 1024 bytes as non-compliant and reject them — do not raise the limit"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client-side sanity: the ID must be short base64url, not raw bytes\nif (resp.id.length > 1400 || !/^[A-Za-z0-9_-]+$/.test(resp.id)) {\n  throw new Error('credential id is not valid base64url or exceeds the 1024-byte limit');\n}","typeGuard":null,"tryCatchPattern":"catch and map to HTTP 400; treat repeated oversized IDs from the same authenticator model as a compatibility signal and surface it in QA reports","preventionTips":["Test the register flow with mainstream browsers/platform authenticators before shipping","Do not hand-construct credential IDs in tests; generate realistic ones under 1024 bytes","Never raise the limit — it is a WebAuthn spec bound, not a tunable"],"tags":["webauthn","credential-id","validation","registration","rust"],"backgroundTag":"webauthn-invalid-credential-id","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}