{"record":{"id":"d4d6965d93dcd360","repo":"nextauthjs/next-auth","slug":"missing-user-registration-data-in-webauthn-challen","errorCode":null,"errorMessage":"Missing user registration data in WebAuthn challenge cookie","messagePattern":"Missing user registration data in WebAuthn challenge cookie","errorType":"exception","errorClass":"AuthError","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/utils/webauthn-utils.ts","lineNumber":345,"sourceCode":"  // Get WebAuthn response from request body\n  const data =\n    request.body && typeof request.body.data === \"string\"\n      ? (JSON.parse(request.body.data) as unknown)\n      : undefined\n  if (\n    !data ||\n    typeof data !== \"object\" ||\n    !(\"id\" in data) ||\n    typeof data.id !== \"string\"\n  ) {\n    throw new AuthError(\"Invalid WebAuthn Registration response\")\n  }\n\n  // Get challenge from request cookies\n  const { challenge: expectedChallenge, registerData: user } =\n    await webauthnChallenge.use(options, request.cookies, resCookies)\n  if (!user) {\n    throw new AuthError(\n      \"Missing user registration data in WebAuthn challenge cookie\"\n    )\n  }\n\n  // Verify the response\n  let verification: VerifiedRegistrationResponse\n  try {\n    const relayingParty = provider.getRelayingParty(options, request)\n    verification = await provider.simpleWebAuthn.verifyRegistrationResponse({\n      ...provider.verifyRegistrationOptions,\n      expectedChallenge,\n      response: data as RegistrationResponseJSON,\n      expectedOrigin: relayingParty.origin,\n      expectedRPID: relayingParty.id,\n    })\n  } catch (e: any) {\n    throw new WebAuthnVerificationError(e)\n  }","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/utils/webauthn-utils.ts#L327-L363","documentation":"verifyRegister retrieves the stored challenge and user registration data from the WebAuthn challenge cookie via webauthnChallenge.use(). The challenge cookie exists but carries no registerData (user info), so registration cannot know which user to attach the new credential to, and this AuthError is thrown.","triggerScenarios":"The registration flow's challenge cookie lacks the registerData payload — options.user was not supplied to startRegistration/registrationFlow, or the cookie was written by a different/older flow version.","commonSituations":"Calling the registration endpoint without passing user (name/email) in options; cookie serialization/deserialization mismatch after library upgrades; cookie truncated by size limits or middleware stripping it; multiple tabs overwriting each other's challenge cookies.","solutions":["Pass user data in the options when initiating registration so registerData is embedded in the challenge cookie","Clear stale cookies and restart the registration flow in a single tab","Upgrade/restart consistently so client and server use the same challenge cookie format","Check middleware/proxy settings that may drop or truncate cookies"],"exampleFix":"// before\nawait WebAuthnBrowser.startRegistration({ challenge: c }) // no user\n// after\nawait registrationFlow({ ..., user: { name: userName, email: userEmail } })","handlingStrategy":"validation","validationCode":"const { registerData: user } = await webauthnChallenge.use(options, request.cookies, resCookies)\nif (!user) {\n  return new Response('Registration session expired, restart the flow', { status: 400 })\n}","typeGuard":null,"tryCatchPattern":"try {\n  await verifyRegister(data)\n} catch (e) {\n  if (e instanceof AuthError && e.message.includes('Missing user registration data')) {\n    // redirect the user to restart the registration flow\n  }\n}","preventionTips":["Always include user (name/email) when starting registration","Complete registration in the same tab/session that started it","Avoid cookie-limiting proxies or keep the challenge cookie small","Clear stale challenge cookies when the flow is abandoned"],"tags":["webauthn","cookies","registration","missing-data"],"backgroundTag":"missing-challenge-cookie-data","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}