bitwarden / bitwarden/clients

Passkey login request not intercepted by Bitwarden on ebay.com

Open
#7,785 17 comments 2 reactions 0 assignees View on GitHub
browser bug
Dominant language
TypeScript
Stars
13.8k
Forks
2k
Avg merge
3d 9h
Merged PRs (30d)
397

Description

### Steps To Reproduce

1. Store a passkey for ebay.com in Bitwarden.
2. Verify that the passkey is stored by reviewing the vault.
3. In an incognito window, visit ebay.com
4. Open the sign-in page and click in the username field.
5. Click "Use a passkey".

### Expected Result

Bitwarden popup should appear offering to supply the stored passkey.

### Actual Result

Windows Hello default security prompt appears.

### Screenshots or Videos

Passkey stored successfully in associated vault item:
![image](https://github.com/bitwarden/clients/assets/382436/cf015481-da85-46c0-91c9-6576c2643e37)

Browser prompt offering to use a passkey:
![image](https://github.com/bitwarden/clients/assets/382436/8198bc57-7bc8-4448-8f86-d9f7d5b8d7d9)

Result of clicking the prompt:
![image](https://github.com/bitwarden/clients/assets/382436/c8075128-8749-4846-b826-bc0739f61269)

### Additional Context

This issue is virtually identical to #7456, which was closed and then reopened because it wasn't fixed.

For the record, passkeys for other sites work absolutely fine (GitHub, Google, etc.).

### Operating System

Windows

### Operating System Version

10 and 11, both with latest updates.

### Web Browser

Chrome

### Browser Version

121.0.6167.140

### Build Version

2024.1.1

### Issue Tracking Info

- [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

No source file or test is named in the issue. Start by reproducing the passkey flow on ebay.com in the Chrome extension on Windows, then trace the browser-extension passkey interception path; done means Bitwarden offers the stored passkey instead of the Windows Hello prompt while other supported sites continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.