From 8f55b731c786d921fe22ba25379ee5b5605a447b Mon Sep 17 00:00:00 2001
From: KaveeshaPiumini <piumini95kaveesha@gmail.com>
Date: Tue, 28 Jul 2026 21:26:41 +0530
Subject: [PATCH] Stop leaking raw WebAuthn error messages to users in passkey
 flows

Passkey ceremonies surfaced the raw browser WebAuthn error message directly
to end users, for example:

  Passkey authentication failed: The operation either timed out or was not
  allowed. See: https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.

The user-facing message of ThunderIDRuntimeError interpolated `error.message`
from the underlying DOMException. Replace it with a clean, stable message and
move the raw browser detail into the developer-info argument, where it remains
available for debugging without being shown to users.

Applied to every ceremony that surfaced the raw message:
- @thunderid/browser: handleWebAuthnAuthentication (default branch)
- @thunderid/react: registration and authentication
- @thunderid/vue: registration and authentication

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../browser/src/utils/handleWebAuthnAuthentication.ts     | 4 ++--
 packages/react/src/utils/passkey.ts                       | 8 ++++----
 packages/vue/src/utils/passkey.ts                         | 8 ++++----
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/packages/browser/src/utils/handleWebAuthnAuthentication.ts b/packages/browser/src/utils/handleWebAuthnAuthentication.ts
index 304402e..8255521 100644
--- a/packages/browser/src/utils/handleWebAuthnAuthentication.ts
+++ b/packages/browser/src/utils/handleWebAuthnAuthentication.ts
@@ -254,10 +254,10 @@ const handleWebAuthnAuthentication = async (challengeData: string): Promise<stri
 
         default:
           throw new ThunderIDRuntimeError(
-            `Passkey authentication failed: ${error.message}`,
+            'Passkey authentication failed. Please try again.',
             'browser-webauthn-general-error',
             'browser',
-            `WebAuthn authentication failed with error: ${error.name}`,
+            `WebAuthn authentication failed with error: ${error.name}: ${error.message}`,
           );
       }
     }
diff --git a/packages/react/src/utils/passkey.ts b/packages/react/src/utils/passkey.ts
index 2f7c8e8..25f2383 100644
--- a/packages/react/src/utils/passkey.ts
+++ b/packages/react/src/utils/passkey.ts
@@ -94,10 +94,10 @@ export const handlePasskeyRegistration = async (challengeData: string): Promise<
     if (error instanceof Error) {
       // Map specific WebAuthn errors to ThunderIDRuntimeError/friendly messages as needed
       throw new ThunderIDRuntimeError(
-        `Passkey registration failed: ${error.message}`,
+        'Passkey registration failed. Please try again.',
         'browser-webauthn-registration-error',
         'browser',
-        `WebAuthn registration failed with error: ${error.name}`,
+        `WebAuthn registration failed with error: ${error.name}: ${error.message}`,
       );
     }
 
@@ -182,10 +182,10 @@ export const handlePasskeyAuthentication = async (challengeData: string): Promis
 
     if (error instanceof Error) {
       throw new ThunderIDRuntimeError(
-        `Passkey authentication failed: ${error.message}`,
+        'Passkey authentication failed. Please try again.',
         'browser-webauthn-authentication-error',
         'browser',
-        `WebAuthn authentication failed with error: ${error.name}`,
+        `WebAuthn authentication failed with error: ${error.name}: ${error.message}`,
       );
     }
 
diff --git a/packages/vue/src/utils/passkey.ts b/packages/vue/src/utils/passkey.ts
index d8dbc4c..cf50e85 100644
--- a/packages/vue/src/utils/passkey.ts
+++ b/packages/vue/src/utils/passkey.ts
@@ -91,10 +91,10 @@ export const handlePasskeyRegistration = async (challengeData: string): Promise<
 
     if (error instanceof Error) {
       throw new ThunderIDRuntimeError(
-        `Passkey registration failed: ${error.message}`,
+        'Passkey registration failed. Please try again.',
         'browser-webauthn-registration-error',
         'browser',
-        `WebAuthn registration failed with error: ${error.name}`,
+        `WebAuthn registration failed with error: ${error.name}: ${error.message}`,
       );
     }
 
@@ -177,10 +177,10 @@ export const handlePasskeyAuthentication = async (challengeData: string): Promis
 
     if (error instanceof Error) {
       throw new ThunderIDRuntimeError(
-        `Passkey authentication failed: ${error.message}`,
+        'Passkey authentication failed. Please try again.',
         'browser-webauthn-authentication-error',
         'browser',
-        `WebAuthn authentication failed with error: ${error.name}`,
+        `WebAuthn authentication failed with error: ${error.name}: ${error.message}`,
       );
     }