[PM-25632] Log in with device - entered email is case-sensitive for fingerprint phrase generation
- Dominant language
- Kotlin
- Stars
- 9.4k
- Forks
- 1.1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 67
Description
### Steps To Reproduce
1. Have an existing BW client logged in
2. Begin new device login from Android app
3. Enter email address with arbitrary capitalisation (eg autocomplete capitalising first letter)
4. Choose Log in with device
5. Note fingerprint phrase mismatch between devices
### Expected Result
Login attempt either fails to recognise account, or completes successfully with matching fingerprint.
### Actual Result
Existing device receives an auth prompt with mismatched fingerprint phrase.
### Screenshots or Videos
_No response_
### Additional Context
The desktop apps convert email to lowercase before generating fingerprint in [desktop auth-request.service.ts:224](https://github.com/bitwarden/clients/blob/main/libs/auth/src/common/services/auth-request/auth-request.service.ts#L224).
The Android app does not, see [Android AuthRequestManagerImpl.kt:472](https://github.com/bitwarden/android/blob/main/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestManagerImpl.kt#L472) and [Android AuthSdkSourceImpl.kt:45](https://github.com/bitwarden/android/blob/main/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/AuthSdkSourceImpl.kt#L45).
From what I can see in the iOS codebase it also seems to use the provided email without lowercasing it, see [iOS AuthService.swift:832](https://github.com/bitwarden/ios/blob/main/BitwardenShared/Core/Auth/Services/AuthService.swift#L832)
### Build Version
2025.8.1 (20670)
### What server are you connecting to?
US
### Self-host Server Version
_No response_
### Environment Details
_No response_
### Issue Tracking Info
- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Contributor guide
Research direction
Start with AuthRequestManagerImpl.kt:472 and AuthSdkSourceImpl.kt:45, then compare the desktop auth-request.service.ts:224 behavior and the iOS AuthService.swift:832 path. Trace how the entered email reaches fingerprint phrase generation and verify that differently capitalized inputs produce the expected matching fingerprint during device login.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100