wordpress-mobile / wordpress-mobile/WordPress-Android

Wordpress app: Can't login to the site if there's a 2FA plugin

Open
#20,890 4 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Type] Bug
Dominant language
Kotlin
Stars
3.2k
Forks
1.4k
Avg merge
1d 11h
Merged PRs (30d)
69

Description

Following several app reviews, if the site has a plugin that enables 2FA authentication, you can't log in to the app with a user with 2FA enabled as it results in an error.

App Reviews:

  • p1698441537158879-slack-C0130RXKCUU
  • p1697119457887059-slack-C0130RXKCUU
  • p1677277560627759-slack-C0130RXKCUU
Expected behavior

The app can log in to a site using a user with 2FA enabled via a 2FA plugin installed on the site.

Actual behavior

The app can't log in to a site using a user with 2FA enabled via a 2FA plugin installed on the site.

Steps to reproduce the behavior
  1. Create a self-hosted site (e.g. create a Jurassic Ninja site).
  2. Install a 2FA plugin (e.g. https://wordpress.org/plugins/wordfence/).
  3. Create a new user and enable 2FA.
  4. Open the app.
  5. Try to add the new self-hosted site.
  6. Try to log in using the credentials of the 2FA user.
  7. Observe the login process fails with an error.
Tested on iPhone 11, iOS 17.0.2, WordPress iOS 25.0.
Tested on Samsung Galaxy S20 FE 5G, Android 13, WPAndroid 25.0-rc-1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failed login using the WordPress 2FA-plugin setup described in the issue, then trace the Android app's authentication flow and its handling of the login response. Done means a user with plugin-enabled 2FA can add the self-hosted site and log in successfully without the reported error.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.