Flask Session -> Double Token

backend/webauthn_mgr.py

@@ -155,10 +155,10 @@ def complete_registration(request, credential: dict) -> dict:
     expected_challenge = _REGISTRATION_CHALLENGES.pop(challenge_key, None)
     if not expected_challenge:
         # Self-registration fallback: the browser may not echo the user handle,
-        # so resolve the target from the session user.
+        # so resolve the target from the authenticated request context.
         try:
-            from flask import session
-            uid = session.get("user_id")
+            from backend.auth import current_user_id
+            uid = current_user_id()
             if uid is not None:
                 challenge_key = f"reg_{uid}"
                 expected_challenge = _REGISTRATION_CHALLENGES.pop(challenge_key, None)