[BUG] 2FA problem: Does not take authorization in the first go
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 4.2k
- Forks
- 3.1k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 7
Description
Actual behaviour
-When you authorize using 2FA (here: via Free OTP) you have to perform the authentication procedure twice.
Expected behaviour
-The app should accept the authorization the first time it is presented
Steps to reproduce
- Start OwnCloud app and connect to the cloud
- You get redirected due to authorization expiration, so you enter your credentials in the Web browser that is opened for you, then you create the token for 2FA (here: via Free OTP) and enter it. In the browser the cloud opens up and also a popup comes that asks you "open in app?"
- Agree to opening in the app, OwnCloud app comes up again, but: complains about expiration once more, so go back to step 2 and repeat everything. This time the autorization gets accepted.
Can this problem be reproduced with the official owncloud server?
(url: https://ocis.ocis.master.owncloud.works, user: einstein, password: relativity)
Haven't tried so far.
Environment data
Android version:
10 (AOSP, Fairphone Open OS 23.02.0-rel.0 (latest version)
Device model:
Fairphone 2
Stock or customized system:
AOSP, but officially supported the manufacturer of the phone (Fairphone).
ownCloud app version:
4.4.1 (latest) - but this behaviour was also present on the two previous versions
ownCloud server version:
unknown (hosted by my employer).
Logs
Web server error log
Insert your webserver log here
ownCloud log (data/owncloud.log)
Insert your ownCloud log here
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the flow in the OwnCloud Android app: expiration, browser credentials, Free OTP, and the "open in app?" handoff. Compare the first and second authorization attempts and inspect the app and browser authorization transition. Done means a valid 2FA authorization is accepted on the first attempt; add logs if reproduction requires more evidence.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100