feat(auth): password verification for Sync after passkey signin by vbudhram · Pull Request #20571 · mozilla/fxa

vbudhram · 2026-05-11T20:03:05Z

Because

Sync OAuth needs the wrapped Sync keys (kB), which require a fresh authPW after a passwordless passkey signin
The SigninPasskeyFallback page existed but had no backend integration or route, so the flow was unreachable

This pull request

Wires SigninPasskeyFallback to /session/reauth?keys=true via authClient.sessionReauth, routes it at /signin_passkey_fallback, and hydrates from cached session on refresh (container.tsx, App/index.tsx)
Suppresses duplicate signin notifications when /session/reauth runs on a passkey-verified session, since the passkey signin already fired them (session.js)
Adds beginPasskeyAuthentication and completePasskeyAuthentication to fxa-auth-client for the new-device passkey ceremony (client.ts)
Fixes a pre-existing bug in /passkey/authentication/finish where sessionToken.id (HKDF-derived) was returned in place of sessionToken.data (seed), breaking client-side Hawk re-derivation (passkeys.ts)

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-13096
Closes: https://mozilla-hub.atlassian.net/browse/FXA-13100

Checklist

My commit is GPG signed.
If applicable, I have modified or added tests which pass locally.
I have added necessary documentation (if appropriate).
I have verified that my changes render correctly in RTL (if appropriate).
I have manually reviewed all AI generated code.

Other information

How to test:

Sign up and complete Sync OAuth signin via the Sync entry-point pages
From Settings, enable a passkey (requires MFA confirmation)
Simulate the new-device passkey signin via authClient.beginPasskeyAuthentication / completePasskeyAuthentication (the entry-point button is tracked separately)
Navigate to /signin_passkey_fallback with Sync OAuth params, enter the account password, click Continue
Verify the OAuthLogin webchannel message carries the https://identity.mozilla.com/apps/oldsync scope and the user lands in Sync

Copilot

Pull request overview

Adds a reachable “passkey sign-in → password verification” fallback flow so Sync OAuth can obtain wrapped Sync keys after a passwordless (passkey) sign-in, and fixes passkey session token material returned from the auth-server.

Changes:

fxa-settings: Route and wire SigninPasskeyFallback to /session/reauth?keys=true, including refresh-safe hydration from cached session state.
fxa-auth-server: Suppress duplicate sign-in notifications on /session/reauth for passkey-verified sessions; fix /passkey/authentication/finish to return the session token seed (data) instead of HKDF-derived id.
fxa-auth-client + tests: Add passkey authentication ceremony helpers and add functional/integration coverage for the passkey→password fallback Sync flow.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/fxa-settings/src/pages/Signin/SigninPasskeyFallback/index.tsx	Adds UI wiring for submitting password, showing email, and displaying localized backend errors.
packages/fxa-settings/src/pages/Signin/SigninPasskeyFallback/index.test.tsx	Replaces snapshot test with behavioral tests for callbacks and error banner rendering.
packages/fxa-settings/src/pages/Signin/SigninPasskeyFallback/index.stories.tsx	Updates stories to exercise handlers and error banner state.
packages/fxa-settings/src/pages/Signin/SigninPasskeyFallback/container.tsx	New container integrating OAuth navigation + `/session/reauth?keys=true` for Sync key retrieval.
packages/fxa-settings/src/pages/Signin/SigninPasskeyFallback/snapshots/index.test.tsx.snap	Removes obsolete snapshot after switching to behavioral tests.
packages/fxa-settings/src/components/App/index.tsx	Routes `/signin_passkey_fallback` to the new container.
packages/fxa-auth-server/test/remote/passkeys.in.spec.ts	Adds remote integration coverage for passkey session + `/session/reauth?keys=true` keyFetchToken issuance.
packages/fxa-auth-server/lib/routes/session.spec.ts	Adds unit coverage that `/session/reauth` skips sign-in notifications for passkey sessions.
packages/fxa-auth-server/lib/routes/session.js	Implements notification suppression for passkey-verified sessions during reauth.
packages/fxa-auth-server/lib/routes/passkeys.ts	Fixes `/passkey/authentication/finish` to return `sessionToken.data` (seed) instead of `sessionToken.id`.
packages/fxa-auth-server/lib/routes/passkeys.spec.ts	Updates expectations/mocks for the corrected session token return value.
packages/fxa-auth-client/lib/client.ts	Adds `beginPasskeyAuthentication` and `completePasskeyAuthentication` methods to the public client API.
packages/functional-tests/tests/passkeys/passkeyPasswordFallback.spec.ts	Adds an end-to-end Playwright test covering passkey sign-in + fallback password submit leading to Sync OAuthLogin.
packages/functional-tests/lib/passkeyPolyfill.ts	Exposes raw minted credential objects for “new device” ceremony simulation in tests.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

vpomerleau · 2026-05-15T20:02:33Z

+  if (oAuthDataError) {
+    return <OAuthDataError error={oAuthDataError} />;
+  }
+
+  if (!sessionToken || !email) {
+    navigateWithQuery('/');
+    return <AppLayout loading />;
+  }


This seems like a valid comment

vpomerleau · 2026-05-15T20:04:08Z

+  /**
+   * Starts a passkey authentication ceremony, returning the WebAuthn
+   * `PublicKeyCredentialRequestOptions` for the browser.
+   */
+  async beginPasskeyAuthentication(
+    headers?: Headers
+  ): Promise<PublicKeyCredentialRequestOptionsJSON> {
+    return this.request('POST', '/passkey/authentication/start', {}, headers);
+  }
+
+  /**
+   * Completes a passkey authentication ceremony by submitting the assertion
+   * and the original challenge. Returns a passkey-verified session token.
+   *
+   * @param response Assertion produced by `navigator.credentials.get`.
+   * @param challenge The challenge string returned by `beginPasskeyAuthentication`.
+   * @param service Optional client identifier (`'sync'` triggers
+   *   `requiresPasswordForSync` in the response).
+   */
+  async completePasskeyAuthentication(
+    response: AuthenticationResponseJSON,
+    challenge: string,
+    service?: string,
+    headers?: Headers
+  ): Promise<{
+    uid: hexstring;
+    sessionToken: hexstring;
+    verified: boolean;
+    requiresPasswordForSync: boolean;
+    hasPassword: boolean;
+  }> {
+    return this.request(
+      'POST',
+      '/passkey/authentication/finish',
+      service ? { response, challenge, service } : { response, challenge },
+      headers
+    );
+  }


Outdated, no longer in PR. This is also mentioned in the PR description - update for consistency?

vbudhram · 2026-05-13T01:35:30Z

+      // Simulate a fresh device: drop all cached signin state from the initial
+      // Sync OAuth flow so the fallback page hydrates purely from the
+      // passkey-verified session we seed below.
+      await page.context().clearCookies();


This will need follow-up, but figured a net positive to have something exercising the flow end to end. The test simulates a verified passkey login, seeds the resulting session into localStorage, then signin_passkey_fallback from the browser.

Because: - Sync needs the wrapped sync keys (kB) to complete OAuth, which require a fresh authPW after a passwordless passkey signin. - The fallback page existed but had no backend integration or entry route. This commit: - Wires SigninPasskeyFallback to /session/reauth?keys=true via authClient.sessionReauth, routes it at /signin_passkey_fallback, and hydrates from cached session on refresh. - Suppresses redundant signin notifications when /session/reauth runs on a passkey-verified session (the passkey signin already fired them). - Adds auth-client methods for the passkey authentication ceremony. - Fixes a pre-existing bug in /passkey/authentication/finish where sessionToken.id (HKDF-derived) was returned in place of sessionToken.data. - Adds unit and integration tests and a browser-driven Playwright spec covering the full Sync OAuth, passkey, fallback flow.

vpomerleau

This is looking good and is probably ok to land independently - but optionally you could rebase/wait on #20575 to test out the E2E flow.

Comments are nice to have but not blocking.

vpomerleau · 2026-05-15T20:05:22Z

+    rpId,
+  });
+  return target.authClient.completePasskeyAuthentication(
+    assertion as any,


nit: Could drop as any or use the actual type PublicKeyCredentialJSON

vpomerleau · 2026-05-15T20:09:15Z

        <h1 className="card-header mb-4">Enter your password to sync</h1>
      </FtlMsg>

+      {email && (


The design may have changed a tad since this page was first created - it looks like the avatar is also included now. This would be a good time to update to match: https://www.figma.com/design/4ToDEuz5HU1HyBrFCIZe4v/Passkeys?node-id=3036-65903&t=DSWA1DCh8GoxOaXz-4

vpomerleau · 2026-05-15T20:18:20Z


  return (
    <AppLayout>
+      {localizedErrorMessage && (


Was going to say that our banners are usually below the heading, but I see this matches Figma. I'll ask Laurel if we can standardize (non-blocker here)

Copilot AI review requested due to automatic review settings May 11, 2026 20:03

vbudhram requested a review from a team as a code owner May 11, 2026 20:03

Copilot started reviewing on behalf of vbudhram May 11, 2026 20:03 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

vbudhram force-pushed the fxa-13096 branch from 473f925 to 5167cf9 Compare May 11, 2026 20:48

vbudhram self-assigned this May 11, 2026

vbudhram force-pushed the fxa-13096 branch 10 times, most recently from 43bd6bb to b392d63 Compare May 13, 2026 00:58

vbudhram commented May 13, 2026

View reviewed changes

vbudhram force-pushed the fxa-13096 branch from b392d63 to 2c5f9c3 Compare May 13, 2026 01:37

vbudhram requested a review from vpomerleau May 13, 2026 18:20

vpomerleau approved these changes May 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(auth): password verification for Sync after passkey signin#20571

feat(auth): password verification for Sync after passkey signin#20571
vbudhram wants to merge 1 commit into
mainfrom
fxa-13096

vbudhram commented May 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

vpomerleau May 15, 2026

Uh oh!

vpomerleau May 15, 2026

Uh oh!

vbudhram May 13, 2026

Uh oh!

vpomerleau left a comment

Uh oh!

vpomerleau May 15, 2026

Uh oh!

vpomerleau May 15, 2026

Uh oh!

vpomerleau May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

vbudhram commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Because

This pull request

Issue that this pull request solves

Checklist

Other information

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

vpomerleau May 15, 2026

Choose a reason for hiding this comment

Uh oh!

vpomerleau May 15, 2026

Choose a reason for hiding this comment

Uh oh!

vbudhram May 13, 2026

Choose a reason for hiding this comment

Uh oh!

vpomerleau left a comment

Choose a reason for hiding this comment

Uh oh!

vpomerleau May 15, 2026

Choose a reason for hiding this comment

Uh oh!

vpomerleau May 15, 2026

Choose a reason for hiding this comment

Uh oh!

vpomerleau May 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vbudhram commented May 11, 2026 •

edited

Loading