[2.1] Attestation promise return is all undefined

[miken32]

Bundler & Interpreter

Vite 7.3.1 Node 22.22.0

Browser & OS

Firefox 149/Safari 26.3 macOS 26.3

Have you done this?

• I have checked my logs and I am sure is a bug in this package.
• I can reproduce this bug in isolation (vanilla install)
• I can suggest a workaround as a Pull Request

Expectation

I expect to be able to create a passkey

Description

During passkey creation, the passkey is created correctly on both the server and client. But the attestation promise contains only undefined values. The call to wfetch is returning undefined, even though the browser network inspector shows a successful request and 204 response.

Reproduction

import Webpass from "@laragear/webpass";

if (Webpass.isSupported()) {
    document.getElementById("passkey-add")?.addEventListener("click", async function(e) {
        e.preventDefault();
        e.stopPropagation();
        const { credential, success, error } = await Webpass.attest("/webauthn/register/options", "/webauthn/register");
        if (success) {
            window.location.replace(`/passkeys/${credential.id}/edit`);
        } else {
            throw error
        }
    });
}

Stack trace & logs

[miken32]

Server side code is just the same as this BTW: https://github.com/Laragear/WebAuthn/blob/4.x/stubs/controllers/WebAuthnRegisterController.php

Also I'm 95% sure I was testing with this same code in December with no problems.

[DarkGhostHunter]

It's fine. The final response from the server can be empty, since the attestation is already completed. In other words, the ceremony was a success.

You may want to change the response by adding the credentials or else, but most users won't need it. Personally I just notify the user the attestation was successful and that he can review is passkeys in a route.

[miken32]

That makes sense; but since there is a credentials property in the return, would a PR making attestRaw() return result ?? credentials instead of just result cause any problems?

[DarkGhostHunter]

Yep. attestRaw should be used if you want the full server response. attest should be used if you want convenience.

[miken32]

Well even using attestRaw() there's no way to get the initial server response containing the credentials if the second response is empty. Hopefully there are no problems with committing PR #43 to address this.