From 44b176fa053b3b2baa94c7d73e247da75aa294e1 Mon Sep 17 00:00:00 2001 From: Santiago Rodriguez <46354312+santiagorodriguez96@users.noreply.github.com> Date: Thu, 22 Oct 2026 12:52:34 -0300 Subject: [PATCH 1/3] feat: bump default `credential_options_timeout` to 300_000 WebAuthn Level 3 recommends a ceremony timeout between 300_000 and 600_000 milliseconds, with 300_000 (5 minutes) as the default. Our previous default of 120_000 was below that range. https://www.w3.org/TR/webauthn-3/#sctn-timeout-recommended-range --- README.md | 2 +- docs/advanced_configuration.md | 2 +- lib/webauthn/relying_party.rb | 2 +- spec/webauthn/credential_creation_options_spec.rb | 2 +- spec/webauthn/credential_request_options_spec.rb | 2 +- spec/webauthn/public_key_credential/creation_options_spec.rb | 4 ++-- spec/webauthn/public_key_credential/request_options_spec.rb | 4 ++-- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index cd92735b..3cab41a2 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,7 @@ WebAuthn.configure do |config| # interaction with the user. # This hint may be overridden by the browser. # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout - # config.credential_options_timeout = 120_000 + # config.credential_options_timeout = 300_000 # You can optionally specify a different Relying Party ID # (https://www.w3.org/TR/webauthn/#relying-party-identifier) diff --git a/docs/advanced_configuration.md b/docs/advanced_configuration.md index 2454065b..1b998817 100644 --- a/docs/advanced_configuration.md +++ b/docs/advanced_configuration.md @@ -32,7 +32,7 @@ Instead of the [Global Configuration](../README.md#configuration) you place in ` # interaction with the user. # This hint may be overridden by the browser. # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout - # credential_options_timeout: 120_000 + # credential_options_timeout: 300_000 # You can optionally specify a different Relying Party ID # (https://www.w3.org/TR/webauthn/#relying-party-identifier) diff --git a/lib/webauthn/relying_party.rb b/lib/webauthn/relying_party.rb index 2b6db690..74503b43 100644 --- a/lib/webauthn/relying_party.rb +++ b/lib/webauthn/relying_party.rb @@ -25,7 +25,7 @@ def initialize( name: nil, verify_attestation_statement: true, verify_cross_origin: false, - credential_options_timeout: 120000, + credential_options_timeout: 300_000, silent_authentication: false, acceptable_attestation_types: ['None', 'Self', 'Basic', 'AttCA', 'Basic_or_AttCA', 'AnonCA'], attestation_root_certificates_finders: [], diff --git a/spec/webauthn/credential_creation_options_spec.rb b/spec/webauthn/credential_creation_options_spec.rb index 01a5f465..f5c52dd8 100644 --- a/spec/webauthn/credential_creation_options_spec.rb +++ b/spec/webauthn/credential_creation_options_spec.rb @@ -71,7 +71,7 @@ context "client timeout" do it "has a default client timeout" do - expect(creation_options.timeout).to(eq(120000)) + expect(creation_options.timeout).to(eq(300000)) end context "when client timeout is configured" do diff --git a/spec/webauthn/credential_request_options_spec.rb b/spec/webauthn/credential_request_options_spec.rb index 23b9f503..ada9dfc6 100644 --- a/spec/webauthn/credential_request_options_spec.rb +++ b/spec/webauthn/credential_request_options_spec.rb @@ -18,7 +18,7 @@ context "client timeout" do it "has a default client timeout" do - expect(request_options.timeout).to(eq(120000)) + expect(request_options.timeout).to(eq(300000)) end context "when client timeout is configured" do diff --git a/spec/webauthn/public_key_credential/creation_options_spec.rb b/spec/webauthn/public_key_credential/creation_options_spec.rb index 9c5ab71b..260b9366 100644 --- a/spec/webauthn/public_key_credential/creation_options_spec.rb +++ b/spec/webauthn/public_key_credential/creation_options_spec.rb @@ -76,7 +76,7 @@ context "client timeout" do it "has a default client timeout" do - expect(creation_options.timeout).to(eq(120000)) + expect(creation_options.timeout).to(eq(300000)) end context "when client timeout is configured" do @@ -147,7 +147,7 @@ expect(hash[:pubKeyCredParams]).to eq( [{ type: "public-key", alg: -7 }, { type: "public-key", alg: -37 }, { type: "public-key", alg: -257 }] ) - expect(hash[:timeout]).to eq(120_000) + expect(hash[:timeout]).to eq(300_000) expect(hash[:challenge]).to be_truthy expect(hash[:extensions]).to eq({}) expect(hash).not_to have_key(:excludeCredentials) diff --git a/spec/webauthn/public_key_credential/request_options_spec.rb b/spec/webauthn/public_key_credential/request_options_spec.rb index da03ae41..f56ca20d 100644 --- a/spec/webauthn/public_key_credential/request_options_spec.rb +++ b/spec/webauthn/public_key_credential/request_options_spec.rb @@ -18,7 +18,7 @@ context "client timeout" do it "has a default client timeout" do - expect(request_options.timeout).to(eq(120000)) + expect(request_options.timeout).to(eq(300000)) end context "when client timeout is configured" do @@ -72,7 +72,7 @@ hash = options.as_json - expect(hash[:timeout]).to eq(120_000) + expect(hash[:timeout]).to eq(300_000) expect(hash[:allowCredentials]).to eq([]) expect(hash[:extensions]).to eq({}) expect(hash[:challenge]).to be_truthy From 4a63b335d8f46ab20209911972e7f15c5cff5ff3 Mon Sep 17 00:00:00 2001 From: Santiago Rodriguez <46354312+santiagorodriguez96@users.noreply.github.com> Date: Thu, 22 Oct 2026 12:52:34 -0300 Subject: [PATCH 2/3] docs: add CHANGELOG entry for default `credential_options_timeout` bump --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 127d5532..76506110 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ - Add support for crossOrigin/topOrigin verification during credential registration and authentication. [#486](https://github.com/cedarcode/webauthn-ruby/pull/486) [@nicolastemciuc] +### Changed + +- Bump the default `credential_options_timeout` from `120_000` to `300_000` milliseconds (5 minutes). [@santiagorodriguez96] + ## [v3.4.3](https://github.com/cedarcode/webauthn-ruby/compare/v3.4.2...v3.4.3/) - 2025-10-23 ### Fixed From e7796adc8d63a59e5254cd59bb7143ceed817a3d Mon Sep 17 00:00:00 2001 From: Santiago Rodriguez <46354312+santiagorodriguez96@users.noreply.github.com> Date: Thu, 22 Oct 2026 14:38:32 -0300 Subject: [PATCH 3/3] docs: add missing PR link to CHANGELOG --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9dfd3098..b3b792f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,7 @@ ### Changed -- Bump the default `credential_options_timeout` from `120_000` to `300_000` milliseconds (5 minutes). [@santiagorodriguez96] +- Bump the default `credential_options_timeout` from `120_000` to `300_000` milliseconds (5 minutes). [#515](https://github.com/cedarcode/webauthn-ruby/pull/515) [@santiagorodriguez96] ### Removed