WebAuthn: Avoid submitting the wrong form#769
Merged
claudep merged 1 commit intojazzband:masterfrom Jul 9, 2025
Merged
Conversation
If the template is modified/overridden, there could be other forms before the two-factor one. This selects the form based on the tokenField input.
claudep
approved these changes
Jul 9, 2025
Contributor
claudep
left a comment
There was a problem hiding this comment.
Thanks, it looks totally reasonable.
|
@claudep a release would be nice. this is bothering me too |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
If the template is modified/overridden, there could be other forms before the two-factor one. This selects the form based on the tokenField input. This uses the
Element.closestmethod that "traverses the element and its parents", which should be available to 95.2% of users according to Can I Use?.Motivation and Context
I'm working on an internal project to integrate two-factor login to the Django admin (as others have tried: #169), and so far so good, but if the passkey setup is done inside the admin panel, the logout form (link) is triggered instead the two-factor form, since the Javascript selects the form based on the
document.forms[0]line. This instead searches the closest form to the two-factor token input.No, this small merge request does not integrate the project into the django-admin. But I could eventually work in a PR to do this, if everything goes as expected.
How Has This Been Tested?
I'm running this modification and testing it live in my django-admin environment. I haven't tested further since it's not a profound change.
Screenshots (if appropriate):
In the screenshot, you can see the WebAuthn setup integrated to the admin. Once the token is activated, it was triggering the logout action and I didn't understand why, until I saw how the form was being selected.
(congratulations screen)
With this small fix, I can successfully store the key on my account.
Types of changes
Checklist: