element-hq / element-hq/element-ios
Forcing another session to log out does not support WebAuthn
- Dominant language
- Swift
- Stars
- 1.8k
- Forks
- 544
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
Where are you starting? What can you see?
User Settings -> Security -> My Sessions -> Tap on a session -> Tap on "Sign out this session"
Then, by coincidence, it requires me to re-authenticate with my social identity provider, in this case GitHub.
GitHub then requires me to use my security key, because I use 2FA with GitHub.
I tap the use security key button in the web page.
It says "authentication failed", despite using it earlier to sign into this device.
----
Other notes:
I have experienced this with the Cisco AnyConnect app. We had to change our configuration so the iOS app uses a slightly different web view technology.
Something about how `SFSafariWebView`
[Apple Documentation: `ASWebAuthenticationSession`](https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession)
[Yubico: No reaction when using WebAuthn on macOS, iOS and iPadOS](https://support.yubico.com/hc/en-us/articles/360022004600-No-reaction-when-using-WebAuthn-on-macOS-iOS-and-iPadOS)
[Apple: Meet Face ID and Touch ID for the Web](https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/)
Element has no control on what or how the scripts run on a social login provider. This issue likely will only be resolved by switching the web view technology that comes up when tapping "Sign out this session".
### Outcome
#### What did you expect?
I expect to be able to use my security key to authenticate with GitHub and then return to Element's UI to remove the session.
#### What happened instead?
I was blocked
### Your phone model
iPhone 13 Pro Max
### Operating system version
17.0.3
### Application version
_No response_
### Homeserver
_No response_
### Will you send logs?
Yes
Contributor guide
Assessment
This issue has not been assessed yet.