authgear / authgear/authgear-server
[Enter Password page] Passkey dialog keeps popping up on auto page refresh if there is expired browser tab in same session
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Background
- Environment: Staging
- Testing project: qa-app (or any with passkey enabled)
- Testing account: joyz+2@oursky.com (or any with passkey setup)
## Description
If user account has passkey setup, whenever accessing "Enter password" page, the passkey dialog will show automatically.
It is found that if the following conditions are all hit:
- User has reset password
- User has clicked "Use passkey instead" on "Enter password" page
- There is an expired browser tab in the same session
- Putting the Enter password page in idle
The page will automatically refresh every 30s, and the Passkey dialog will popup everytime.
This could be annoying to user if they are doing other things else at the moment, and just leaving the tab there not yet logged in, but the passkey dialog keeps popping up on screen.
## Steps to reproduce
1. Sign up an account with passkey
2. Forgot password
3. Send instruction and go back to Log in page (Tab 1)
4. Open reset password email
5. Reset password and land on password reset page (Tab 2)
6. Go back to Tab 1
7. Enter email and click Log in, see Enter password page
8. Passkey dialog pops up once, ignore first
9. Click "Use Passkey instead", but cancel the passkey login
10. Stay on the page and wait
11. Page refresh and passkey dialog shows up every 30s
If I close the expired tab (Tab 2), seems it will stop the refreshing and not popping the passkey dialog.
## Expected result
Not sure which part is wrong actually, maybe the page is not expected to refresh in this case and triggering the passkey dialog.
## Video
https://vimeo.com/781762231 (pw: authgear2022)
Contributor guide
Research direction
Start at the Enter password page and reproduce the reset-password flow with an expired tab in the same session, then observe the 30-second refresh and passkey prompt. Trace which session or tab state causes the refresh and confirm that the completed work prevents repeated passkey dialogs while the page remains idle.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100