FIDO/CTAP: Account chooser not shown during username-less login with multiple accounts
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 14.6k
- Forks
- 3.2k
- Avg merge
- 12d 11h
- Merged PRs (30d)
- 4
Description
Describe the bug
When attempting a username-less login using a FIDO2.1 security key that contains multiple discoverable credentials, the system automatically defaults to logging into one of the accounts without displaying an account chooser.
To Reproduce
Steps to reproduce the behavior:
Go to 'https://webauthn.io/'
Enable the "Discoverable Credential" option and register account A.
Repeat the steps to register account B and account C under the same settings.
Clear the username field on the login page and click "Log In".
Complete the authentication, and observe that the system automatically logs into one of the accounts by default without presenting any choices.
Expected behavior
When the username field is left blank, an account chooser (credential selector) should be triggered, allowing the user to manually select which account (A, B, or C) to log into.
Screenshots
(Add screenshots here if needed)
System
Android Version: 15
Custom ROM: None
Additional context
Authenticator Device: FIDO2.1 Security Key (NFC/USB)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the username-less login on https://webauthn.io/ with multiple discoverable credentials using an Android 15 device and a FIDO2.1 security key. Start by tracing the Android FIDO/CTAP authentication flow and credential-selection handling. Done means blank-username authentication presents a chooser for accounts A, B, and C instead of selecting one automatically.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100