{"record":{"id":"e7a6bb5b02f1db32","repo":"quarkusio/quarkus","slug":"res-statustext","errorCode":null,"errorMessage":"res.statusText","messagePattern":"res\\.statusText","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"extensions/security-webauthn/runtime/src/main/resources/webauthn.js","lineNumber":134,"sourceCode":"  }\n\n  WebAuthn.prototype.registerClientSteps = function (user) {\n    const self = this;\n    if (!self.registerOptionsChallengePath) {\n      return Promise.reject('Register challenge path missing form the initial configuration!');\n    }\n    return self.fetchWithCsrf(self.registerOptionsChallengePath + \"?\" + new URLSearchParams({username: user.username, displayName: user.displayName}).toString(), {\n      method: 'GET',\n      headers: {\n        'Accept': 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded'\n      }\n    })\n      .then(res => {\n        if (res.status === 200) {\n          return res;\n        }\n        throw new Error(res.statusText, {cause: res});\n      })\n      .then(res => res.json())\n      .then(res => {\n        res.challenge = base64ToBuffer(res.challenge);\n        res.user.id = base64ToBuffer(res.user.id);\n        if (res.excludeCredentials) {\n          for (let i = 0; i < res.excludeCredentials.length; i++) {\n            res.excludeCredentials[i].id = base64ToBuffer(res.excludeCredentials[i].id);\n          }\n        }\n        return res;\n      })\n      .then(res => navigator.credentials.create({publicKey: res}))\n      .then(credential => {\n          return {\n            id: credential.id,\n            rawId: bufferToBase64(credential.rawId),\n            response: {","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security-webauthn/runtime/src/main/resources/webauthn.js#L116-L152","documentation":"In webauthn.js, after fetching the registration challenge/options from the server, the promise chain throws Error(res.statusText) when the HTTP response status is not exactly 200. The full response is attached as cause so callers can inspect it.","triggerScenarios":"The fetch to the registration challenge endpoint (registerOptionsChallengePath, e.g. /q/webauthn/register-options-challenge) returns a status other than 200 - 401 unauthenticated, 404 wrong path, 403 CSRF rejection, 500 server error.","commonSituations":"User not logged in when requesting register options; misconfigured quarkus.security.webauthn registration paths; the backend endpoint rejected the request (CSRF cookie missing, anonymous access denied); server-side exception during challenge creation.","solutions":["Log the error.cause response to see the actual HTTP status and body; fix the endpoint condition that caused it","Ensure the user is authenticated before calling webauthn.register() if the options endpoint requires it","Verify registerOptionsChallengePath matches the Quarkus WebAuthn endpoint and that the route permits the request","Check CSRF cookie handling: fetch must include credentials/cookies so the CSRF token matches"],"exampleFix":"webauthn.registerOptionsChallengePath = '/wrong/url';\n// after\nwebauthn.registerOptionsChallengePath = '/q/webauthn/register-options-challenge';","handlingStrategy":"try-catch","validationCode":"// before requesting options, confirm the endpoint is reachable:\n// fetch(webauthn.registerOptionsChallengePath, {method:'HEAD'}).then(r => console.log(r.status))","typeGuard":null,"tryCatchPattern":"webauthn.register(user)\n  .catch(err => {\n    if (err.cause) err.cause.text().then(body => console.error('register options failed', err.cause.status, body));\n    else console.error(err);\n  });","preventionTips":["Verify the options-challenge path in the browser devtools Network tab","Ensure the user session is authenticated before requesting register options","Keep CSRF cookies intact (same-origin fetch with credentials)","Map the endpoint to permit the request in your security policy"],"tags":["webauthn","javascript","http","browser"],"backgroundTag":"http-non-2xx-response","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}