microsoft / microsoft/WindowsAppSDK
UWP => WinUI3 migration: PasswordVault cannot be accessed anymore
- Dominant language
- C++
- Stars
- 4.7k
- Forks
- 471
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 28
Description
### Describe the bug
We are storing a randomly generated key inside the [PasswordVault](https://learn.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault?view=winrt-22621) in order to encrypt and decrypt user data serialized to an xml (for improved security).
This is working fine for both the UWP and the WinUi3 applications on their own.
However, if the user was updating from UWP to WinUi3 application (package friendly name, etc. are identical, whereas the OS also handles this as an update!) the previously stored credentials are no longer retrievable!
Thus any encrypted serialization data in place prior to the update is now lost and no longer usable.
### Steps to reproduce the bug
1. store credentials in [PasswordVault](https://learn.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault?view=winrt-22621) within UWP app
2. migrate codebase to WinUi3 (PaswordVault class is still present)
3. install app update
4. try to access the previously stored credentials in the very same app
=> Please note, that no entry will be found.
### Expected behavior
After upgrading app, credentials should still be fetchable.
### Screenshots
The below image depicts the 'Credential Manager' (the above entry is from UWP, and the bottom one was generated within the very same app after migrating to WinUi3):

### NuGet package version
Windows App SDK 1.5.3: 1.5.240428000
### Packaging type
Packaged (MSIX)
### Windows version
Windows 11 version 22H2 (22621, 2022 Update)
### IDE
Visual Studio 2022
### Additional context
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the migration described: store credentials through PasswordVault in the UWP app, upgrade the packaged app to WinUI3, and attempt to retrieve them. Compare the Credential Manager entries shown in the issue and determine whether the missing credentials are caused by identity, packaging, or API behavior. Done means documenting the cause and an upgrade-compatible retrieval path or confirming a platform limitation.
Written by the indexing model from the issue text.
Assessment
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100