{"record":{"id":"75e1fc08b158fae4","repo":"gravitational/teleport","slug":"unexpected-nil-response-from-makecredential","errorCode":null,"errorMessage":"unexpected nil response from MakeCredential","messagePattern":"unexpected nil response from MakeCredential","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/webauthnwin/webauthn_windows.go","lineNumber":192,"sourceCode":"// webauthn.dll and returns CredentialCreationResponse.\n// It interacts with both FIDO2 and Windows Hello depending on opts\n// (using auto starts with Windows Hello but there is\n// option to select other devices).\n// Windows Hello keys are always resident.\nfunc (n *nativeImpl) MakeCredential(origin string, in *makeCredentialRequest) (*wantypes.CredentialCreationResponse, error) {\n\thwnd, err := getForegroundWindow()\n\tif err != nil {\n\t\treturn nil, trace.Wrap(err)\n\t}\n\n\tvar out *webauthnCredentialAttestation\n\tret, err := webAuthNAuthenticatorMakeCredential(\n\t\thwnd, in.rp, in.user, in.credParameters, in.clientData, in.opts, &out)\n\tif ret != 0 {\n\t\treturn nil, trace.Wrap(getErrorNameOrLastErr(ret, err))\n\t}\n\tif out == nil {\n\t\treturn nil, errors.New(\"unexpected nil response from MakeCredential\")\n\t}\n\n\t// Note that we need to copy bytes out of `out` if we want to free object.\n\t// That's why bytesFromCBytes is used.\n\tdefer freeCredentialAttestation(out)\n\n\tcredential := bytesFromCBytes(out.cbCredentialID, out.pbCredentialID)\n\n\treturn &wantypes.CredentialCreationResponse{\n\t\tPublicKeyCredential: wantypes.PublicKeyCredential{\n\t\t\tCredential: wantypes.Credential{\n\t\t\t\tID:   base64.RawURLEncoding.EncodeToString(credential),\n\t\t\t\tType: string(protocol.PublicKeyCredentialType),\n\t\t\t},\n\t\t\tRawID: credential,\n\t\t},\n\t\tAttestationResponse: wantypes.AuthenticatorAttestationResponse{\n\t\t\tAuthenticatorResponse: wantypes.AuthenticatorResponse{","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthnwin/webauthn_windows.go#L174-L210","documentation":"MakeCredential calls WebAuthNAuthenticatorMakeCredential in webauthn.dll to register a new credential (Windows Hello or FIDO2 security key). If the API returns success (ret == 0) but the out *webauthnCredentialAttestation pointer is still nil, the wrapper cannot build a CredentialCreationResponse and returns this sentinel error rather than crashing on a nil dereference.","triggerScenarios":"Calling nativeImpl.MakeCredential during credential registration (e.g. `tsh mfa add`, device enrollment) when WebAuthNAuthenticatorMakeCredential reports HR_SUCCESS but does not populate the WEBAUTHN_CREDENTIAL_ATTESTATION output.","commonSituations":"Buggy webauthn.dll on outdated Windows installs; Windows Hello enrollment in a corrupt state during new-credential creation; TPM/attestation failures that the DLL masks as success; virtual machines without a working platform authenticator.","solutions":["Retry the registration; transient Hello/TPM states often succeed on a second attempt.","Install Windows updates to get a fixed webauthn.dll and re-check Windows Hello enrollment in Sign-in options.","Register using a hardware security key (or a different authenticator attachment) instead of Windows Hello.","If reproducible on a supported, updated Windows version, report the bug to Teleport."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Check native support and platform authenticator availability before registration:\nif !native.HasCompileSupport() || !native.IsAvailable() {\n    // choose a non-native registration path\n}","typeGuard":"func attestationAvailable(out *webauthnCredentialAttestation) bool { return out != nil }","tryCatchPattern":"resp, err := native.MakeCredential(origin, req)\nif err != nil {\n    if strings.Contains(err.Error(), \"unexpected nil response\") {\n        // retry once, then fall back to security-key registration\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Ensure Windows Hello is set up and working before enrolling credentials.","Install Windows cumulative updates to get webauthn.dll fixes.","Offer users a security-key alternative when the platform authenticator is unreliable (VMs, missing TPM)."],"tags":["windows","webauthn","cgo","nil-pointer"],"backgroundTag":"webauthn-nil-response","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}