Handle zero matching credentials in allow_list

Yubico · Oct 16, 2024 · 9b5b22e · 9b5b22e
1 parent 696a16d
commit 9b5b22e
Showing 1 changed file with 18 additions and 11 deletions.
diff --git a/fido2/client.py b/fido2/client.py
@@ -483,17 +483,24 @@ def _filter_creds(
             version = None
         matches = []
         for chunk in chunks:
-            assertions = self.ctap2.get_assertions(
-                rp_id,
-                client_data_hash,
-                _cbor_list(chunk),
-                None,
-                {"up": False},
-                pin_auth,
-                version,
-                event=event,
-                on_keepalive=on_keepalive,
-            )
+            try:
+                assertions = self.ctap2.get_assertions(
+                    rp_id,
+                    client_data_hash,
+                    _cbor_list(chunk),
+                    None,
+                    {"up": False},
+                    pin_auth,
+                    version,
+                    event=event,
+                    on_keepalive=on_keepalive,
+                )
+            except CtapError as e:
+                if e.code == CtapError.ERR.NO_CREDENTIALS:
+                    # All creds in chunk are discarded
+                    continue
+                raise
+
             if len(chunk) == 1 and len(assertions) == 1:
                 # Credential ID might be omitted from assertions
                 matches.append(chunk[0])