authgear / authgear/authgear-server

[Enter Password page] Passkey dialog keeps popping up on auto page refresh if there is expired browser tab in same session

Open
#2,730 0 comments 0 reactions 0 assignees View on GitHub
bug/minor reported by qa
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Background
- Environment: Staging
- Testing project: qa-app (or any with passkey enabled)
- Testing account: joyz+2@oursky.com (or any with passkey setup)

## Description
If user account has passkey setup, whenever accessing "Enter password" page, the passkey dialog will show automatically.

It is found that if the following conditions are all hit:
- User has reset password
- User has clicked "Use passkey instead" on "Enter password" page
- There is an expired browser tab in the same session
- Putting the Enter password page in idle

The page will automatically refresh every 30s, and the Passkey dialog will popup everytime.

This could be annoying to user if they are doing other things else at the moment, and just leaving the tab there not yet logged in, but the passkey dialog keeps popping up on screen.

## Steps to reproduce
1. Sign up an account with passkey
2. Forgot password
3. Send instruction and go back to Log in page (Tab 1)
4. Open reset password email
5. Reset password and land on password reset page (Tab 2)
6. Go back to Tab 1
7. Enter email and click Log in, see Enter password page
8. Passkey dialog pops up once, ignore first
9. Click "Use Passkey instead", but cancel the passkey login
10. Stay on the page and wait
11. Page refresh and passkey dialog shows up every 30s

If I close the expired tab (Tab 2), seems it will stop the refreshing and not popping the passkey dialog.

## Expected result
Not sure which part is wrong actually, maybe the page is not expected to refresh in this case and triggering the passkey dialog.

## Video
https://vimeo.com/781762231 (pw: authgear2022)

Contributor guide

Open the contributing guide

Research direction

Start at the Enter password page and reproduce the reset-password flow with an expired tab in the same session, then observe the 30-second refresh and passkey prompt. Trace which session or tab state causes the refresh and confirm that the completed work prevents repeated passkey dialogs while the page remains idle.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.