Revert earlier change to iframe srcdoc, using src instead, because srcdoc was not compatible with all passkey implementations (BitWarden).

passkey/fastapi/authz.py

@@ -2,7 +2,7 @@ import logging
 
 from fastapi import HTTPException
 
-from ..util import frontend, htmlutil, permutil, sessionutil
+from ..util import permutil, sessionutil
 
 logger = logging.getLogger(__name__)
 
@@ -35,16 +35,17 @@ class AuthException(HTTPException):
 async def auth_error_content(exc: AuthException) -> dict:
     """Generate JSON response content for an AuthException.
 
-    Returns a dict with detail, mode, and iframe HTML for srcdoc embedding.
+    Returns a dict with detail, mode, and iframe URL for src embedding.
     """
-    data_attrs = {"mode": exc.mode, **exc.metadata}
-    iframe_html = (await frontend.read("/auth/restricted/index.html"))[0]
-    iframe_html = htmlutil.patch_html_data_attrs(iframe_html, **data_attrs)
+    # Build hash fragment from mode and metadata
+    params = {"mode": exc.mode, **exc.metadata}
+    fragment = "&".join(f"{k}={v}" for k, v in params.items() if v is not None)
+    iframe_url = f"/auth/restricted/#{fragment}"
     return {
         "detail": exc.detail,
         "auth": {
             "mode": exc.mode,
-            "iframe": iframe_html.decode("utf-8"),
+            "iframe": iframe_url,
             **exc.metadata,
         },
     }

passkey/fastapi/ws.py

@@ -56,7 +56,7 @@ async def register_chat(
         credential_ids=credential_ids,
         origin=origin,
     )
-    await ws.send_json(options)
+    await ws.send_json({"optionsJSON": options})
     response = await ws.receive_json()
     return passkey.instance.reg_verify(response, challenge, user_uuid, origin=origin)
 
@@ -150,7 +150,7 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):
     options, challenge = passkey.instance.auth_generate_options(
         credential_ids=credential_ids
     )
-    await ws.send_json(options)
+    await ws.send_json({"optionsJSON": options})
     # Wait for the client to use his authenticator to authenticate
     credential = passkey.instance.auth_parse(await ws.receive_json())
     # Fetch from the database by credential ID

passkey/sansio.py

@@ -184,7 +184,7 @@ class Passkey:
             authopts: Additional arguments to generate_authentication_options.
 
         Returns:
-            Tuple of (JSON to be sent to client, challenge bytes to store)
+            Tuple of (JSON dict to be sent to client, challenge bytes to store)
         """
         options = generate_authentication_options(
             rp_id=self.rp_id,