From 4857052cf0ed69eea31653f9482fd3d7f6b0b615 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20Ciarcin=CC=81ski?= <adam@defguard.net>
Date: Tue, 8 Sep 2026 11:58:30 +0200
Subject: [PATCH] FIDO2: take 2

---
 common/client_types.proto | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/common/client_types.proto b/common/client_types.proto
index a1ae8c5..06d98c1 100644
--- a/common/client_types.proto
+++ b/common/client_types.proto
@@ -344,7 +344,6 @@ message ClientMfaStartResponse {
 
 message ClientMfaFinishRequest {
   string token = 1;
-  // [2.2] For FIDO2 this holds the hash of RP ID.
   optional string code = 2;
   // [2.2] For FIDO2 this holds the signature.
   optional string auth_pub_key = 3;
@@ -355,10 +354,9 @@ message ClientMfaFinishRequest {
   optional string step_attempt_id = 4;
   // [2.2] FIDO2
   optional bytes auth_data = 5;
-  // [2.2] For FIDO2: which credential actually signed, base64url. Picked by the
-  // key out of the list it was offered, so Core knows which of the user's
-  // security keys is in use.
-  optional string credential_id = 6;
+  // [2.2] For FIDO2: which credential actually signed. Picked by the key out of the list
+  // it was offered, so Core knows which of the user's security keys is in use.
+  optional bytes credential_id = 6;
 }
 
 message ClientMfaFinishResponse {