Handle a WebAuthn signature-counter anomaly without guessing

Name the behavior under review

This review is for authentication teams evaluating authenticator clone signals. Start with one observable claim: record authenticator capabilities and apply policy to a non-increasing counter. Record the repository revision, environment, test identity, time source, and reviewer.

Keep the first run small. A teammate in another time zone should be able to repeat it without reconstructing assumptions from chat.

Capture an ordinary run

Save credential ID, authenticator data, stored and returned counters, backup flags, result, and policy action. Use synthetic or approved test data and avoid broad production access. The baseline is useful only when its inputs and expected outcome are written down.

If the baseline fails, repair the fixture or narrow the question before adding timing, load, or failure conditions.

Review record

Scroll sideways to read every column on a small screen.

Exercise the boundary case

Test the case most likely to expose a bad assumption: a multi-device credential always returns a zero counter. Change one condition, preserve raw output, and timestamp both the trigger and result.

Repeat the nearest passing case after the failure. That comparison is more useful than a pile of unrelated logs.

Make the smallest supported correction

Trace the evidence to the first boundary that violates the stated behavior. Add a focused regression check, prepare a reversible correction, and rerun both cases.

Record adjacent risks separately, with an owner and a reason they remain outside this change.

Hand off the decision

An offshore developer can design fixtures, inspect code, prepare a patch, and assemble evidence. The internal owner retains protected credentials, sensitive data, exceptions, and production release authority.

The handoff names revisions, changed files, commands, passed and skipped checks, rollback, remaining uncertainty, and the next owner.

Questions about assessing Philippine developers