feat(user): allow renaming security keys (webauthn/passkey) (#39413)

Closes https://github.com/go-gitea/gitea/issues/39287

Security key nicknames could only be set at registration, so a skipped
nickname left an auto-generated hex name until the key was
re-registered. Each key now has a Rename button opening a dialog with
the current nickname. A nickname used by another of the user's keys
(case-insensitive) or a blank nickname is rejected. Renames are recorded
as `user:webauth:rename` audit events.

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
authored and GitHub committed 2026-10-05 19:12:22 +02:00
1 parent 66546045b5
commit d16b20b972
17 files changed
+142 -21

No files matched your search

+2 -1
View File
@@ -87,6 +87,7 @@
"add_all": "Add All",
"dismiss": "Dismiss",
"remove": "Remove",
"rename": "Rename",
"remove_all": "Remove All",
"remove_label_str": "Remove item \"%s\"",
"edit": "Edit",
@@ -798,7 +799,6 @@
"settings.add_key_success": "The SSH key \"%s\" has been added.",
"settings.add_gpg_key_success": "The GPG key \"%s\" has been added.",
"settings.add_principal_success": "The SSH certificate principal \"%s\" has been added.",
"settings.delete_key": "Remove",
"settings.ssh_key_deletion": "Remove SSH Key",
"settings.gpg_key_deletion": "Remove GPG Key",
"settings.ssh_principal_deletion": "Remove SSH Certificate Principal",
@@ -907,6 +907,7 @@
"settings.webauthn_desc": "Security keys are hardware devices containing cryptographic keys. They can be used for two-factor authentication. Security keys must support the <a rel=\"noreferrer\" target=\"_blank\" href=\"%s\">WebAuthn Authenticator</a> standard.",
"settings.webauthn_register_key": "Add Security Key",
"settings.webauthn_nickname": "Nickname",
"settings.webauthn_nickname_been_used": "A security key with the same nickname already exists.",
"settings.webauthn_delete_key": "Remove Security Key",
"settings.webauthn_delete_key_desc": "If you remove a security key, you can no longer sign in with it. Continue?",
"settings.webauthn_key_loss_warning": "If you lose your security keys, you will lose access to your account.",