quarkusio/quarkus · error · Error

res.statusText

Error message

res.statusText

What it means

In webauthn.js, after fetching the registration challenge/options from the server, the promise chain throws Error(res.statusText) when the HTTP response status is not exactly 200. The full response is attached as cause so callers can inspect it.

Source

Thrown at extensions/security-webauthn/runtime/src/main/resources/webauthn.js:134

  }

  WebAuthn.prototype.registerClientSteps = function (user) {
    const self = this;
    if (!self.registerOptionsChallengePath) {
      return Promise.reject('Register challenge path missing form the initial configuration!');
    }
    return self.fetchWithCsrf(self.registerOptionsChallengePath + "?" + new URLSearchParams({username: user.username, displayName: user.displayName}).toString(), {
      method: 'GET',
      headers: {
        'Accept': 'application/json',
        'Content-Type': 'application/x-www-form-urlencoded'
      }
    })
      .then(res => {
        if (res.status === 200) {
          return res;
        }
        throw new Error(res.statusText, {cause: res});
      })
      .then(res => res.json())
      .then(res => {
        res.challenge = base64ToBuffer(res.challenge);
        res.user.id = base64ToBuffer(res.user.id);
        if (res.excludeCredentials) {
          for (let i = 0; i < res.excludeCredentials.length; i++) {
            res.excludeCredentials[i].id = base64ToBuffer(res.excludeCredentials[i].id);
          }
        }
        return res;
      })
      .then(res => navigator.credentials.create({publicKey: res}))
      .then(credential => {
          return {
            id: credential.id,
            rawId: bufferToBase64(credential.rawId),
            response: {

View on GitHub (pinned to e1c734241f)

Solutions

1. Log the error.cause response to see the actual HTTP status and body; fix the endpoint condition that caused it
2. Ensure the user is authenticated before calling webauthn.register() if the options endpoint requires it
3. Verify registerOptionsChallengePath matches the Quarkus WebAuthn endpoint and that the route permits the request
4. Check CSRF cookie handling: fetch must include credentials/cookies so the CSRF token matches

Example fix

webauthn.registerOptionsChallengePath = '/wrong/url';
// after
webauthn.registerOptionsChallengePath = '/q/webauthn/register-options-challenge';

// before requesting options, confirm the endpoint is reachable:
// fetch(webauthn.registerOptionsChallengePath, {method:'HEAD'}).then(r => console.log(r.status))

webauthn.register(user)
  .catch(err => {
    if (err.cause) err.cause.text().then(body => console.error('register options failed', err.cause.status, body));
    else console.error(err);
  });

When it happens

Trigger: The fetch to the registration challenge endpoint (registerOptionsChallengePath, e.g. /q/webauthn/register-options-challenge) returns a status other than 200 - 401 unauthenticated, 404 wrong path, 403 CSRF rejection, 500 server error.

Common situations: User not logged in when requesting register options; misconfigured quarkus.security.webauthn registration paths; the backend endpoint rejected the request (CSRF cookie missing, anonymous access denied); server-side exception during challenge creation.

Related errors

• Register path is missing!
• Login path is missing!
• ${status} ${statusText}: ${body}
• IOException(e)
• OIDC discovery endpoint request failed

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e7a6bb5b02f1db32. Report an issue: GitHub.