From dde8430677284d787e924c7539a825d170b00c18 Mon Sep 17 00:00:00 2001 From: Joel Ferrier Date: Mon, 3 Aug 2026 14:32:31 +0000 Subject: [PATCH] fix: Use user_verification=discouraged for Reauth WebAuthn challenge. When a fido2 compliant security key is used, and a PIN is configured, the user_verification=preferred value forces PIN authentication. The Reauth API security key challenge is modeled on U2F which does not expose UV requirements. This change removes the PIN prompt requirement for Google Cloud customers with fido2 security keys and session length controls enabled which require security key reauth. --- packages/google-auth/google/oauth2/challenges.py | 2 +- packages/google-auth/tests/oauth2/test_challenges.py | 2 +- packages/google-auth/tests/oauth2/test_webauthn_types.py | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/google-auth/google/oauth2/challenges.py b/packages/google-auth/google/oauth2/challenges.py index 59a2f9be4f43..64541bd99775 100644 --- a/packages/google-auth/google/oauth2/challenges.py +++ b/packages/google-auth/google/oauth2/challenges.py @@ -225,7 +225,7 @@ def _obtain_challenge_input_webauthn(self, metadata, webauthn_handler): challenge=self._unpadded_urlsafe_b64recode(challenge), timeout_ms=WEBAUTHN_TIMEOUT_MS, allow_credentials=allow_credentials, - user_verification="preferred", + user_verification="discouraged", extensions=extension, ) diff --git a/packages/google-auth/tests/oauth2/test_challenges.py b/packages/google-auth/tests/oauth2/test_challenges.py index fb5e164d50bd..4a9355743118 100644 --- a/packages/google-auth/tests/oauth2/test_challenges.py +++ b/packages/google-auth/tests/oauth2/test_challenges.py @@ -235,7 +235,7 @@ def test_security_key_webauthn(): challenge=challenge._unpadded_urlsafe_b64recode(sk_challenge["challenge"]), timeout_ms=challenges.WEBAUTHN_TIMEOUT_MS, allow_credentials=allow_credentials, - user_verification="preferred", + user_verification="discouraged", extensions=extension, ) diff --git a/packages/google-auth/tests/oauth2/test_webauthn_types.py b/packages/google-auth/tests/oauth2/test_webauthn_types.py index c11ecb4d0a9e..0d052982c272 100644 --- a/packages/google-auth/tests/oauth2/test_webauthn_types.py +++ b/packages/google-auth/tests/oauth2/test_webauthn_types.py @@ -69,7 +69,7 @@ def test_GetRequest(has_allow_credentials): challenge="fake_challenge", timeout_ms=123, allow_credentials=allow_credentials if has_allow_credentials else None, - user_verification="preferred", + user_verification="discouraged", extensions=webauthn_types.AuthenticationExtensionsClientInputs( appid="fake_appid" ), @@ -85,7 +85,7 @@ def test_GetRequest(has_allow_credentials): "rpId": "fake_rpid", "timeout": 123, "challenge": "fake_challenge", - "userVerification": "preferred", + "userVerification": "discouraged", "extensions": {"appid": "fake_appid"}, }, }