{"record":{"id":"f92039e72a436a5d","repo":"nextauthjs/next-auth","slug":"webauthn-registration-response-could-not-be-verifi","errorCode":null,"errorMessage":"WebAuthn registration response could not be verified","messagePattern":"WebAuthn registration response could not be verified","errorType":"exception","errorClass":"WebAuthnVerificationError","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/utils/webauthn-utils.ts","lineNumber":367,"sourceCode":"\n  // Verify the response\n  let verification: VerifiedRegistrationResponse\n  try {\n    const relayingParty = provider.getRelayingParty(options, request)\n    verification = await provider.simpleWebAuthn.verifyRegistrationResponse({\n      ...provider.verifyRegistrationOptions,\n      expectedChallenge,\n      response: data as RegistrationResponseJSON,\n      expectedOrigin: relayingParty.origin,\n      expectedRPID: relayingParty.id,\n    })\n  } catch (e: any) {\n    throw new WebAuthnVerificationError(e)\n  }\n\n  // Make sure the response was verified\n  if (!verification.verified || !verification.registrationInfo) {\n    throw new WebAuthnVerificationError(\n      \"WebAuthn registration response could not be verified\"\n    )\n  }\n\n  // Build a new account\n  const account = {\n    providerAccountId: toBase64(verification.registrationInfo.credentialID),\n    provider: options.provider.id,\n    type: provider.type,\n  }\n\n  // Build a new authenticator\n  const authenticator = {\n    providerAccountId: account.providerAccountId,\n    counter: verification.registrationInfo.counter,\n    credentialID: toBase64(verification.registrationInfo.credentialID),\n    credentialPublicKey: toBase64(\n      verification.registrationInfo.credentialPublicKey","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/utils/webauthn-utils.ts#L349-L385","documentation":"The attestation response shape and challenge data were accepted, but @simplewebauthn/server's verifyRegistrationResponse returned verified:false or missing registrationInfo, so the registration cannot be trusted. Thrown as a WebAuthnVerificationError.","triggerScenarios":"verifyRegister receives an attestation that fails verification — challenge mismatch with the cookie, origin/rpID mismatch, unsupported attestation format, or device not eligible for passkey creation.","commonSituations":"rpID/origin configured for a different domain than the client; challenge cookie expired or replaced between start and verify; attestation format (e.g. 'none' vs 'packed') unsupported by the @simplewebauthn/server version; browser/platform restrictions (e.g. no platform authenticator available).","solutions":["Align WebAuthnProvider rpID and origin with the actual client origin","Ensure the challenge cookie from startRegistration is intact and unchanged at verify time","Check @simplewebauthn/server version supports the client's attestation format","Test on a platform/browser that supports the configured authenticatorSelection requirements"],"exampleFix":"// before\nWebAuthnProvider({ id: \"prod.example.com\" }) // testing on localhost\n// after\nWebAuthnProvider({ id: \"localhost\", origin: \"http://localhost:3000\" })","handlingStrategy":"try-catch","validationCode":"// environment pre-check\nconsole.assert(provider.rpID === location.hostname, 'rpID must match the client origin')\nconsole.assert(document.cookie.includes('next-auth.webauthn-challenge'), 'challenge cookie must exist')","typeGuard":null,"tryCatchPattern":"try {\n  await verifyRegister(data)\n} catch (e) {\n  if (e instanceof WebAuthnVerificationError) {\n    // clear cookies, log attestation failure, restart registration\n    return new Response('Attestation verification failed', { status: 400 })\n  }\n  throw e\n}","preventionTips":["Match rpID/origin to each deployment environment","Pin compatible @simplewebauthn/server versions with the provider","Test passkey creation on all target browsers/platforms","Never skip the challenge cookie in proxied deployments"],"tags":["webauthn","verification","registration","attestation"],"backgroundTag":"webauthn-verification-failed","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}