Skip to content

Passkey Backup Eligibility flag is always set to true #444

@droidmonkey

Description

@droidmonkey

Description
Howdy, KeePassXC lead developer here. We recently got a bug report that highlighted a deficiency in our passkey implementation. Looks like we both hard code the value of Backup Eligibility (BE) but do it differently. I noticed in your code that your authentication data is always set to true for all flags based on some bit logic:

let flags = AuthDataFlags.at
| AuthDataFlags.uv
| AuthDataFlags.up
| AuthDataFlags.be
| AuthDataFlags.bs

We need to introduce a new parameter in the advanced attributes to store the value of the Backup Eligibility, OR, we need to agree on which value to send to relying parties. This will cause problems if we all of a sudden switch this up on users as shown in the parent issue that started all this: pocket-id/pocket-id#397

How to reproduce
Steps to reproduce the behavior:

  1. Create passkey in either KeePassXC or KeePassium
  2. Try to use the passkey on a site being strict about BE with the other app
  3. Login will fail

Expected behavior
We should have consistency with our BE flag by declaring its state at time of creation and storing that declaration.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions