What is the problem?
On iPhone, when asked to authenticate with a WebAuthn device, if it times out or you cancel, you cannot then authenticate with a WebAuthn device anymore, not even after logging in (with a different 2FA method), trying to login as a different user with WebAuthn or clearing cookies.
I have reproduced this on Safari on iPhone 14 but not on iPhone 15.
Found by @AAlhazwani-WMF.
Steps to reproduce problem
- Login to beta
- Go to https://auth.wikimedia.beta.wmcloud.org/enwiki/w/index.php?title=Special:AccountSecurity
- Click "Add security key" and add your security key (e.g. a yubikey)
- On an iPhone, attempt to login on beta with the same user
- After entering your username and password, you will be prompted to enter a security key. Instead, cancel by closing the popup
- Reload the page and try to login again (you might be asked for your username and password again)
Expected behaviour: You get the prompt to enter your security key again.
Observed behaviour: It immediately shows you a failure ("Authentication process was interrupted...")
Environment
Operating system: iPhone 14 iOS 16.3.
Browser: Safari.
Wiki(s): https://en.wikipedia.beta.wmflabs.org OATHAuth – (a0b34f0) 07:34, 6 October 2025. WebAuthn – (1957699) 20:10, 3 October 2025.