chore: disable webauthn login by default

Author: muety

README.md

@@ -196,7 +196,7 @@ You can specify configuration options either via a config file (default: `config
 | `server.base_path` /<br> `WAKAPI_BASE_PATH`                                                 | `/`                                              | Web base path (change when running behind a proxy under a sub-path)                                                                                                             |
 | `server.public_url` /<br> `WAKAPI_PUBLIC_URL`                                               | `http://localhost:3000`                          | URL at which your Wakapi instance can be found publicly                                                                                                                         |
 | `security.disable_local_auth` /<br> `WAKAPI_DISABLE_LOCAL_AUTH`                             | `false`                                          | Disables login via local credentials (username and password) to enforce OIDC provider login                                                                                     |
-| `security.disable_webauthn` /<br> `WAKAPI_DISABLE_WEBAUTHN`                               | `false`                                          | Disables login via WebAuthn (security keys, biometrics, etc.)                                                                                                                   |
+| `security.disable_webauthn` /<br> `WAKAPI_DISABLE_WEBAUTHN`                                 | `true`                                           | Disables login via WebAuthn (security keys, biometrics, etc.)                                                                                                                   |
 | `security.password_salt` /<br> `WAKAPI_PASSWORD_SALT`                                       | -                                                | Pepper to use for password hashing                                                                                                                                              |
 | `security.insecure_cookies` /<br> `WAKAPI_INSECURE_COOKIES`                                 | `true`                                           | Whether or not to allow cookies over HTTP. For production, it is **highly recommended** to serve Wakapi via HTTPS and set this to `false`.                                      |
 | `security.cookie_max_age` /<br> `WAKAPI_COOKIE_MAX_AGE`                                     | `172800`                                         | Lifetime of authentication cookies in seconds or `0` to use [Session](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Define_the_lifetime_of_a_cookie) cookies        |

config.default.yml

@@ -88,7 +88,7 @@ security:
   allow_signup: true                    # whether to allow new user creation at all
   oidc_allow_signup: true               # allow registration of new users from oidc
   disable_local_auth: false             # disable login via local credentials (username and password) to enforce OIDC provider login
-  disable_webauthn: false                # disable login via webauthn (security keys, biometrics, etc.)
+  disable_webauthn: true                # disable login via webauthn (security keys, biometrics, etc.)
   signup_captcha: false
   invite_codes: true                    # whether to enable invite codes for overriding disabled signups
   disable_frontpage: false

config/config.go

@@ -126,7 +126,7 @@ type securityConfig struct {
 	AllowSignup      bool `yaml:"allow_signup" default:"true" env:"WAKAPI_ALLOW_SIGNUP"`
 	OidcAllowSignup  bool `yaml:"oidc_allow_signup" default:"true" env:"WAKAPI_OIDC_ALLOW_SIGNUP"`
 	DisableLocalAuth bool `yaml:"disable_local_auth" default:"false" env:"WAKAPI_DISABLE_LOCAL_AUTH"`
-	DisableWebAuthn  bool `yaml:"disable_webauthn" default:"false" env:"WAKAPI_DISABLE_WEBAUTHN"`
+	DisableWebAuthn  bool `yaml:"disable_webauthn" default:"true" env:"WAKAPI_DISABLE_WEBAUTHN"`
 	SignupCaptcha    bool `yaml:"signup_captcha" default:"false" env:"WAKAPI_SIGNUP_CAPTCHA"`
 	InviteCodes      bool `yaml:"invite_codes" default:"true" env:"WAKAPI_INVITE_CODES"`
 	ExposeMetrics    bool `yaml:"expose_metrics" default:"false" env:"WAKAPI_EXPOSE_METRICS"`