github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-08 04:16:40 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[PR #3658] [PM-10373] Fix FIDO 2 credential creation from unprivileged apps #10463

New Issue
Closed
opened 2026-04-11 02:42:42 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-11 02:42:42 -05:00
Owner
Copy Link

Original Pull Request: https://github.com/bitwarden/android/pull/3658

State: closed
Merged: Yes

🎟️ Tracking

PM-10373

📔 Objective

This pull request fixes incorrect arguments passed to Bitwarden SDK when handling passkey registration and authentication requests from unprivileged applications.

When registering a passkey from an unprivileged application, Bitwarden SDK expects ClientData.DefaultWithExtraData.androidPackageName to be the calling application package name. However, during authentication ClientData.DefaultWithExtraData.androidPackageName is the apk-key-hash.

Bitwarden SDK requires origin to be a valid HTTP URL, including the protocol preamble, when performing registration and authentication.

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
    issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes
**Original Pull Request:** https://github.com/bitwarden/android/pull/3658 **State:** closed **Merged:** Yes --- ## 🎟️ Tracking PM-10373 ## 📔 Objective This pull request fixes incorrect arguments passed to Bitwarden SDK when handling passkey registration and authentication requests from unprivileged applications. When registering a passkey from an unprivileged application, Bitwarden SDK expects `ClientData.DefaultWithExtraData.androidPackageName` to be the calling application package name. However, during authentication `ClientData.DefaultWithExtraData.androidPackageName` is the apk-key-hash. Bitwarden SDK requires `origin` to be a valid HTTP URL, including the protocol preamble, when performing registration and authentication. ## ⏰ Reminders before review - Contributor guidelines followed - All formatters and local linters executed and passed - Written new unit and / or integration tests where applicable - Used internationalization (i18n) for all UI strings - CI builds passed - Communicated to DevOps any deployment requirements - Updated any necessary documentation or informed the documentation team ## 🦮 Reviewer guidelines <!-- Suggested interactions but feel free to use (or not) as you desire! --> - 👍 (`:+1:`) or similar for great changes - 📝 (`:memo:`) or ℹ️ (`:information_source:`) for notes or general info - ❓ (`:question:`) for questions - 🤔 (`:thinking:`) or 💭 (`:thought_balloon:`) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion - 🎨 (`:art:`) for suggestions / improvements - ❌ (`:x:`) or ⚠️ (`:warning:`) for more significant problems or concerns needing attention - 🌱 (`:seedling:`) or ♻️ (`:recycle:`) for future improvements or indications of technical debt - ⛏ (`:pick:`) for minor or nitpick changes
GiteaMirror added the pull-request label 2026-04-11 02:42:42 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#10463
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?