Better handle registration/authentication errors

[grzuy]

Handle gracefully exception and error conditions in registration/authentication flow and inform the user with clear message so that it can take action to recover from the error and proceed successfully.

Scenarios:

• Registration―Username is taken
• Registration―Missing credential nickname
• Registration―Invalid WebAuthn attestation (Moved to Handle WebAuthn verification errors #62)
• Sign in―Username is not registered
• Sign in―Invalid WebAuthn assertion (Moved to Handle WebAuthn verification errors #62)

[sandergroen]

@grzuy I addition to the list above. In the current registration flow a user is persisted in the create method of the registrations controller. Is it not a good idea to persist the user when the registration succeeds? The challenge could be stored in a session.

[grzuy]

@grzuy I addition to the list above. In the current registration flow a user is persisted in the create method of the registrations controller. Is it not a good idea to persist the user when the registration succeeds? The challenge could be stored in a session.

Agree.

Created new issue for that #59.

Thanks for bringing that to our attention.