feat: add a cache challenge store by RenzoMinelli · Pull Request #152 · cedarcode/devise-webauthn

RenzoMinelli · 2026-09-25T18:46:23Z

What: Adds ChallengeStores::Cache (:cache), which keeps WebAuthn challenges in Rails.cache instead of the session.

Why: Clients without a cookie session cannot use the session store. Support for those API clients follows in #153.

Decisions:

With no session, the store finds the challenge through the credential's clientDataJSON.
The store reads the credential from the request, so the feat: add configurable challenge store for WebAuthn challenges #150 interface does not change.
The cache key holds a SHA-256 digest of the challenge, so keys have a fixed length.
The cache must be shared by all servers. MemoryStore and FileStore are not.

How to test: bundle exec rspec spec/devise/webauthn/challenge_stores spec/requests/devise/cache_challenge_store_spec.rb. The request spec asks for the challenge and signs in from a different session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- `ChallengeStores::Cache` finds the challenge through the credential's clientDataJSON and consumes it once. - Accept `public_key_credential` as a JSON object or string. - Respect `skip_session_storage` (`:params_auth`) in both WebAuthn strategies. - Load the options controllers under an `ActionController::API` parent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…request Stores already receive the request, so callers no longer pass the credential and the store interface stays as merged in #150. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Also memoize the credential and its challenge, and simplify the spec setup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This PR only adds the cache challenge store. JSON object credentials, `skip_session_storage` and the `ActionController::API` parent move to a follow-up, together with the two-factor flow that still reads the session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Keeps keys a fixed length and keeps raw challenges out of the cache. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- Accept `public_key_credential` as a JSON object or string. - Respect `skip_session_storage` (`:params_auth`) in both WebAuthn strategies. - Load the options controllers under an `ActionController::API` parent. Moved from #152, which now only adds the cache challenge store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

santiagorodriguez96

Looking great! 🔝

Just a couple of small comments!! 💪

santiagorodriguez96 · 2026-10-09T14:36:07Z

+Devise::Webauthn::ChallengeStores::Cache.cache = Rails.cache
+Devise::Webauthn::ChallengeStores::Cache.expires_in = 5.minutes


I think I'd like to give more thought to this interface, but we can leave for a follow up PR 🙂

Sounds good, let's do that in a follow-up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

passkey_authentication_spec covers the controller and store contract, and cache_spec covers the Cache store without a session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- Accept `public_key_credential` as a JSON object or string. - Respect `skip_session_storage` (`:params_auth`) in both WebAuthn strategies. - Load the options controllers under an `ActionController::API` parent. Moved from #152, which now only adds the cache challenge store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli mentioned this pull request Sep 25, 2026

feat: support passkeys for API clients without a session #153

Open

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link API client entries to #152

87acce5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli mentioned this pull request Sep 25, 2026

test: wait for the new page after forms that redirect to the same URL #155

Merged

RenzoMinelli marked this pull request as draft September 25, 2026 19:04

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link API client entries to #152

05d846d

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--cache-challenge-store branch from 87acce5 to 05d846d Compare September 25, 2026 19:08

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link API client entries to #152

ffe1a99

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--cache-challenge-store branch from 05d846d to ffe1a99 Compare September 25, 2026 19:25

RenzoMinelli force-pushed the rm--cache-challenge-store branch from ffe1a99 to 404ae7c Compare September 25, 2026 20:20

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link API client entries to #152

404ae7c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli added a commit that referenced this pull request Sep 25, 2026

docs(CHANGELOG): link API client entries to #152

9eb1ffd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--cache-challenge-store branch from 404ae7c to 9eb1ffd Compare September 25, 2026 20:34

RenzoMinelli added this pull request to stack #156 October 2, 2026 20:17

RenzoMinelli added a commit that referenced this pull request Oct 2, 2026

docs(CHANGELOG): link API client entries to #152

6646a39

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--cache-challenge-store branch from 9eb1ffd to 6646a39 Compare October 2, 2026 22:06

RenzoMinelli added a commit that referenced this pull request Oct 6, 2026

docs(CHANGELOG): link API client entries to #152

67454f8

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--cache-challenge-store branch from 6646a39 to f69e4d6 Compare October 6, 2026 12:23

santiagorodriguez96 mentioned this pull request Oct 6, 2026

feat: add configurable challenge store for WebAuthn challenges #150

Merged

RenzoMinelli added a commit that referenced this pull request Oct 7, 2026

docs(CHANGELOG): link API client entries to #152

85e40b3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--cache-challenge-store branch from f69e4d6 to 8dd3657 Compare October 7, 2026 13:12

Base automatically changed from rm--challenge-store to master October 7, 2026 21:15

RenzoMinelli force-pushed the rm--cache-challenge-store branch from 8dd3657 to 424e8b8 Compare October 7, 2026 21:15

RenzoMinelli and others added 4 commits October 7, 2026 18:27

docs(CHANGELOG): link API client entries to #152

ed47062

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: mention the cache challenge store in the install template

ccb4ea8

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs: say the cache challenge store needs a cache shared by all servers

0e9c958

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

refactor: let the cache challenge store read the credential from the …

df689de

…request Stores already receive the request, so callers no longer pass the credential and the store interface stays as merged in #150. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli force-pushed the rm--cache-challenge-store branch from 424e8b8 to df689de Compare October 7, 2026 21:33

RenzoMinelli marked this pull request as ready for review October 7, 2026 21:49

santiagorodriguez96 reviewed Oct 8, 2026

View reviewed changes

RenzoMinelli and others added 2 commits October 8, 2026 18:11

refactor: read the cache store challenge with WebAuthn::ClientData

3a05cec

Also memoize the credential and its challenge, and simplify the spec setup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli changed the title ~~feat: add a cache challenge store for API clients without a session~~ feat: add a cache challenge store Oct 8, 2026

RenzoMinelli and others added 2 commits October 8, 2026 18:19

refactor: memoize the cache store challenge, including nil

9e0433c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

refactor: key cache store entries by a digest of the challenge

7604b25

Keeps keys a fixed length and keeps raw challenges out of the cache. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

santiagorodriguez96 reviewed Oct 9, 2026

View reviewed changes

RenzoMinelli and others added 3 commits October 9, 2026 12:35

refactor: split the cache store consume checks into guard clauses

34ddab9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test: check pending? after consume and after expiry

f8a3318

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test: remove the cache challenge store request spec

292bd3a

passkey_authentication_spec covers the controller and store contract, and cache_spec covers the Cache store without a session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

RenzoMinelli requested a review from santiagorodriguez96 October 9, 2026 19:19

santiagorodriguez96 approved these changes Oct 9, 2026

View reviewed changes

RenzoMinelli merged commit 707ce1e into master Oct 9, 2026
31 checks passed

RenzoMinelli deleted the rm--cache-challenge-store branch October 9, 2026 20:30

RenzoMinelli mentioned this pull request Oct 13, 2026

feat: support two-factor sign-in for API clients with a signed token #154

Open

Navigation Menu

Repository navigation

feat: add a cache challenge store - #152

feat: add a cache challenge store#152
RenzoMinelli merged 12 commits into
masterfrom
rm--cache-challenge-store

RenzoMinelli commented Sep 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

santiagorodriguez96 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

santiagorodriguez96 Oct 9, 2026

Uh oh!

RenzoMinelli Oct 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		Devise::Webauthn::ChallengeStores::Cache.cache = Rails.cache
		Devise::Webauthn::ChallengeStores::Cache.expires_in = 5.minutes

Conversation

RenzoMinelli commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

santiagorodriguez96 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

santiagorodriguez96 Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

RenzoMinelli Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

RenzoMinelli commented Sep 25, 2026 •

edited

Loading