fix: require discoverable credentials for passkey registration

[vitorhugo-dotnet]

Root cause

The backend already starts username-less assertions, but passkey registration omitted authenticatorSelection.residentKey. This allowed creation of non-discoverable credentials, which cannot be selected for username-less login.

Fix

Configure registration with:

AuthenticatorSelectionCriteria.builder().residentKey(ResidentKeyRequirement.REQUIRED).build()

and pass it to StartRegistrationOptions.

REQUIRED is intentional: username-less authentication depends on a discoverable credential; PREFERRED would not guarantee one.

No frontend changes were required.

Regression test

Added PasskeyRegistrationOptionsIT, validating the actual HTTP registration-options response contains:

publicKey.authenticatorSelection.residentKey = "required".

TDD proof:

• Before fix: mvn -B -ntp -Dtest=PasskeyRegistrationOptionsIT test failed because authenticatorSelection.residentKey was missing.
• After fix: the same command passes.

Verification

• mvn -B -ntp -Dtest=PasskeyRegistrationOptionsIT test — PASS
• mvn -B -ntp clean verify — PASS

Compatibility

Passkeys registered before this fix may be non-discoverable. Those credentials may need to be removed and registered again after deployment.

[github-actions]

Qodana for JVM

3 new problems were found

Inspection name	Severity	Problems
Nullability and data flow problems	🔶 Warning	1
Mismatched query and update of 'StringBuilder'	🔶 Warning	1
Simplifiable conditional expression	🔶 Warning	1

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.3.2
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions