What causes "Invalid cose algorithm: ${coseAlgorithm}" in quarkusio/quarkus?

Check the persisted publicKeyAlgorithm value in your database and restore it to the original value captured at registration (e.g. -7 ES256, -257 RS256, -8 EdDSA).

quarkusio/quarkus · error · IllegalArgumentException

Invalid cose algorithm: ${coseAlgorithm}

Error message

Invalid cose algorithm: ${coseAlgorithm}

What it means

When reassembling a WebAuthn credential from persisted data, the stored COSE algorithm identifier determines the key type branch (EC2, OKP, RSA). If the resolved COSEAlgorithmIdentifier's key type is none of these, fromRequiredPersistedData throws IllegalArgumentException and WebAuthn login/re-authentication for that credential fails.

Source

Thrown at extensions/security-webauthn/runtime/src/main/java/io/quarkus/security/webauthn/WebAuthnCredentialRecord.java:137

        COSEKey coseKey;
        try {
            switch (coseAlgorithm.getKeyType()) {
                case EC2:
                    coseKey = EC2COSEKey.create((ECPublicKey) KeyFactory.getInstance("EC").generatePublic(x509EncodedKeySpec),
                            coseAlgorithm);
                    break;
                case OKP:
                    coseKey = EdDSACOSEKey
                            .create((EdECPublicKey) KeyFactory.getInstance("EdDSA").generatePublic(x509EncodedKeySpec),
                                    coseAlgorithm);
                    break;
                case RSA:
                    coseKey = RSACOSEKey
                            .create((RSAPublicKey) KeyFactory.getInstance("RSA").generatePublic(x509EncodedKeySpec),
                                    coseAlgorithm);
                    break;
                default:
                    throw new IllegalArgumentException("Invalid cose algorithm: " + coseAlgorithm);
            }
        } catch (InvalidKeySpecException | NoSuchAlgorithmException e) {
            throw new IllegalArgumentException("Invalid public key", e);
        }
        byte[] credentialId = base64UrlDecode(persistedData.credentialId());
        AAGUID aaguid = new AAGUID(persistedData.aaguid());
        AttestedCredentialData attestedCredentialData = new AttestedCredentialData(aaguid, credentialId, coseKey);

        return new WebAuthnCredentialRecord(persistedData.username(), counter, attestedCredentialData);
    }

    /**
     * Record holding all the required persistent fields for logging back someone over WebAuthn.
     */
    public record RequiredPersistedData(
            /**
             * The user name. A single user name may be associated with multiple WebAuthn credentials.
             */

View on GitHub (pinned to e1c734241f)

Solutions

Check the persisted publicKeyAlgorithm value in your database and restore it to the original value captured at registration (e.g. -7 ES256, -257 RS256, -8 EdDSA).
Re-register the affected credential so fresh, correct RequiredPersistedData is stored.
Validate persisted data integrity at write time; never hand-edit these rows.
Ensure the Quarkus WebAuthn extension and webauthn4j versions match across environments sharing the database.

Example fix

// before (persisted)
publicKeyAlgorithm = 999

// after
publicKeyAlgorithm = -7 // ES256, as returned at registration
// or re-register the credential

Defensive patterns

Strategy: validation

Validate before calling

int alg = persistedData.publicKeyAlgorithm();
if (alg != -7 && alg != -257 && alg != -8 && alg != -36 && alg != -47 && alg != -48) {
    throw new IllegalStateException("Unsupported persisted COSE algorithm: " + alg);
}

Try / catch

try {
    record = WebAuthnCredentialRecord.fromRequiredPersistedData(persistedData);
} catch (IllegalArgumentException e) {
    // mark credential unusable; force re-registration
    log.error("Unusable persisted WebAuthn credential, forcing re-registration", e);
    credentialRepository.delete(persistedData.credentialId());
}

Prevention

Persist RequiredPersistedData exactly as produced by getRequiredPersistedData().
Never hand-edit algorithm or key columns in the DB.
Re-register credentials when the extension/webauthn4j version changes behavior.

When it happens

Trigger: Calling WebAuthnCredentialRecord.fromRequiredPersistedData with a RequiredPersistedData whose publicKeyAlgorithm maps to an unsupported COSE key type (anything other than EC2/OKP/RSA), e.g. a corrupted or hand-crafted algorithm number.

Common situations: Persisted data written by a different library version or manually edited rows; database column holding a wrong/garbage algorithm integer; credentials registered with exotic algorithms not supported by webauthn4j's supported set here.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ca7f60fbbfc522c4. Report an issue: GitHub.