mirror of
https://github.com/bitwarden/android.git
synced 2026-05-06 07:48:22 -05:00
[GH-ISSUE #6164] [PM-28157] Passkey error with Revolut app: 'Passkeys not supported for this app' #15017
Open
opened 2026-04-15 01:18:06 -05:00 by GiteaMirror
·
17 comments
No Branch/Tag Specified
main
sdlc/sdk-update
new-item-types/PM-32810_bank-account-view
new-item-types/PM-32810_bank-account
beta-for-qa
BWA-253/not-displaying-totp-coded-with-empty-key
target-sdk-37
vvolkgang/renovate-remove-group
pm-34038/card-scanner-qa-fixes
PM-33982/build-device-screen
PM-30625/filter-out-empty-totp-vault-count
vvolkgang/update-jira-release-notes
new-item-types/PM-34123_new-item-menu
new-item-types/PM-32806_passport
new-item-types/PM-32808_drivers-license
BWA-99/show-next-totp
BWA-99/add-preview-next-totp-code-setting
renovate/glidecompose
chore/improve-android-ui-verification-skill
sync-min-sdk
release/2026.4-rc51
fix/security-sast-22741894-bvwj
related-origin-passkey-creation
release/2026.4-rc50
platform/android-breaking-change-detection
innovation-sprint-2026-send-folder
release/2026.3-rc49
PM-34193-vault-lockout
android-collections
llm/add-resolving-sdk-updates-skill
QA-1523/sanity-test-saucelabs
release/2026.3-rc48
PM-26577-app-links-support
PM-26896-autofill-fix
release/2026.2-rc47
pr-6572
release/2026.2-rc46
release/2026.1-rc45
PM-30644/added-logs-for-debug
PM-30644/quicktile-nav-not-showing-migration
minor-gradle-updates
release/2026.1-rc42
release/2026.1-rc44
release/2026.1-rc43
PM-28834/set-landscape-on-horizonos-devices
PM-28468/validate-and-navigate-to-vault-migration
PM-20026/force-ltr-passwords-and-codes
release/2025.12-rc41
cmcg/testCoverage
PM-29014/talkback-support-for-passwords
release/2025.12-rc40
BRE-1305/publish_test
accept-user-certs
autofill-permissions
release/2025.11-rc39
PM-22479/check-all-certificates-validate-asset-links
release/2025.10-rc38
agalles/android-latest
retro-agent
PM-27001/skip-account-selection-only-one-exists-cxp
release/2025.10-rc37
agalles/test-1118
release/2025.10-rc36
PM-20593-token-refresh
QA-1126b/adding-native-sanity-test
release/2025.9-rc35
pm-25933/sdk-update-password
release/2025.9-rc34
release/2025.8-rc33
agalles/20250821-release
debug-release-issues
pm-24249-allow-automated-prs-for-sdk-updates
release/2025.8-rc32
release/WORKFLOW-TEST-2025.8-rc28
agalles/20250807release
release/2025.07-rc25
release/hotfix-v2025.7.0-bwa
pm-23311/export-vault-policy-bypass
release/2025.07-rc24
authenticator-pm-sync-flags-issue
release/hotfix-v2025.6.0-bwpm
release/2025.06-rc21
agalles/automate-android-fastlane-patch
release/2025.05-rc20
release/2025.04-rc19
languages/basque
release/2025.03-rc19
update-readme
qrcode/feature
innovation/archive/pm-19153-archive-items
qrcode/2-ui-fields
qrcode/1-page
hold-on-biometric-prompt-alternative
release-notes-process
release/2025.02-rc16
bwa-monorepo
PM-8223/new-device-verification-ux-improvements
pm-18451/exempt-from-policies
test-bwa
release/2025.01-rc15
release/2025.01-rc14
release/2024.12-rc13
pm-16670/sync-leave-notice
821
PM-16695/backport-lean-more-new-device-verification
release/hotfix-v2024.11.7
release/2024.11-rc1
pm-11304/collection-add-item-button
PM-14241/disabling-logs-app-crash
poc/offline-editing
new-version-calc
pm-11649/expired-link-services
pm-6702/add-feature-flag
pm-6702/email-verification-feature
pm-9933/marketing-copy-update
pm-6702/registration-flows
update-templates
pm-6701/email-verification-selfhost-registration
v2026.4.0-bwa
v2026.4.0-bwpm
v2026.3.1-bwa
v2026.3.1-bwpm
v2026.3.0-bwpm
v2026.3.0-bwa
v2026.2.1-bwpm
v2026.2.1-bwa
v2026.2.0-bwpm
v2026.2.0-bwa
v2026.1.1-bwa
v2026.1.1-bwpm
temp-test
v2026.1.0-bwpm
v2026.1.0-bwa
v2025.12.1-bwa
v2025.12.1-bwpm
v2025.12.0-bwa
v2025.12.0-bwpm
v2025.11.1-bwpm
v2025.11.1-bwa
v2025.11.0-bwpm
v2025.11.0-bwa
v2025.10.1-bwa
v2025.10.1-bwpm
v2025.10.0-bwa
v2025.10.0-bwpm
v2025.9.1-bwa
v2025.9.1-bwpm
v2025.9.0-bwa
v2025.9.0-bwpm
v2025.8.1-bwa
v2025.8.1-bwpm
v2025.8.0-bwa
v2025.8.0-bwpm
v2025.7.2-bwa
v2025.7.2-bwpm
v2025.7.1-bwa
v2025.7.1-bwpm
v2025.7.0-bwa
v2025.7.0-bwpm
v2025.6.1-bwpm
v2025.6.0-bwa
v2025.6.0-bwpm
v2025.1.0-bwa
v2025.5.0-bwa
v2025.5.0-bwpm
v2025.5.999
2025.4.0
v2025.4.0
untagged-4731eaadac73f3dfbbb8
v2025.3.0
v2025.2.0
untagged-815a165c5d70ffe75bc7
v2025.1.2
v2025.1.1
v2025.1.0
v2024.12.0
untagged-5a76b6392a4c8998c63a
v2024.11.7
v2024.11.6
v2024.11.5
v2024.11.4
v2024.11.3
v2024.11.2
v2024.11.1
v2024.11.0
v2024.10.2
v2024.10.1
v2024.10.0
v2024.9.0
v2024.8.1
v2024.8.0
v2024.7.3
v2024.7.2
v2024.7.1
v2024.7.0
v2024.6.1
v2024.6.0
v2024.5.1
v2024.4.1
v2024.4.2
v2024.4.0
v2024.3.3
v2024.3.1
v2024.3.0
v2024.2.1
v2024.2.0
v2024.1.1
v2024.1.0
v2023.12.0
v2023.10.0
v2023.9.2
maui-single-project-android
v2023.9.1
v2023.9.0
v2023.8.0
v2023.7.0
v2023.5.0
v2023.4.0
v2023.3.2
v2023.3.1
v2023.3.0
v2023.2.0
v2023.1.0
v2022.11.0
v2022.10.0
v2022.9.1
v2022.9.0
v2022.8.0
v2022.6.2
v2022.6.1
v2022.6.0
v2022.05.0
v2.18.0
v2.17.0
v2.16.4
v2.16.3
v2.16.2
v2.16.1
v2.15.0
v2.14.2
v2.14.1
v2.14.0
v2.13.0
v2.12.0
v2.11.3
v2.11.2
v2.11.1
v2.11.0
v2.10.0
v2.9.1
v2.9.0
v2.8.2
v2.8.1
v2.8.0
v2.7.2
v2.7.0
v2.6.1
v2.6.0
v2.5.6
v.2.5.5
v2.5.5
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5.0
v2.4.3
v2.4.2
v2.4.1
v2.4.0
v2.3.1
v2.3.0
v2.2.8
v2.2.7
v2.2.6
v2.2.2
v2.2.1
v2.2.0
v2.1.2
v2.1.0
v2.0.6
v2.0.5
v2.0.4
v2.0.3
v2.0.2
v2.0.1
v2.0.0
v1.22.1
v1.22.0
v1.21.0
v1.20.0
v1.19.0
v1.18.1
v1.18.0
v1.17.0
v1.16.0
v1.15.2
v1.15.1
v1.15.0
v1.14.4
v1.14.1
v1.14.0
v1.13.0
v1.12.2
v1.12.1
v1.12.0
v1.11.1
v1.11.0
v1.10.0
v1.9.0
v1.8.1
v1.8.0
v1.7.0
v1.6.5
v1.6.1
v1.6.0
v1.5.1
v1.5.0
v1.4.4
v1.4.3
v1.4.0
v1.3.0
v1.2.1
v1.2.0
v1.1.0
v1.0.0
v0.0.6
v0.0.5
v0.0.4
v0.0.3
v0.0.2
v0.0.1
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/android#15017
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @samuele-ruffino96 on GitHub (Nov 13, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/6164
Origin
Native Application (non-browser app)
Web URL or App name
Revolut (com.revolut.revolut)
Passkey Action
Build Information
App Version: 2025.10.1 (20867)
Build: release/standard
Operating System: Android 16 (API 36)
Device: Samsung SM-A566E (Galaxy A56)
Additional Information
Related Issue:
This appears similar to #6111, which was closed due to insufficient reproduction information.
I'm providing detailed logs, screenshots, and device information to help investigate this issue.
Steps to reproduce:
Observations:
Attached:
Issue Tracking Info
@bitwarden-bot commented on GitHub (Nov 13, 2025):
Thank you for your report! We've added this to our internal board for review.
ID: PM-28157
@SaintPatrck commented on GitHub (Nov 13, 2025):
Hi @samuele-ruffino96
The logs do indicate a 200 response, but that only means Google's DAL API successfully processed the request and provided a response. The 200 does not indicate the actual result of validation. When I perform the same API call in Postman, I can see that the response body contains an error. Google's DAL API is receiving a redirect response when attempting to retrieve Revolut's
assetlinks.jsonfile. For security reasons the API does not follow redirects.That being said, I do notice the response indicates Google is calling
https://revolut.com.(note the additional.at the end), despite us properly sendinghttps://revolut.com(without the additional.). I have reached out to Google for clarity regarding this behavior. You can track the issue here.Response from Google's DAL API:
@samuele-ruffino96 commented on GitHub (Nov 14, 2025):
Hi @SaintPatrck
Thanks for the detailed explanation and for reaching out to Google about this!
You're absolutely right about the redirect. I've confirmed that
https://revolut.com/.well-known/assetlinks.jsonreturns a 301 redirect tohttps://www.revolut.com/.well-known/assetlinks.json. This is why Google's Digital Asset Links API is failing the verification - as you mentioned, it doesn't follow redirects for security reasons.Regarding the additional
.at the end (https://revolut.com.), I tested this as well and it performs the same redirect (see attached screenshot). From what I found, the trailing dot represents the DNS root and it's technically valid - most HTTP clients handlerevolut.com.identically torevolut.com.It's a bit unusual that Google is using the FQDN format but it shouldn't affect the outcome. I believe the core issue is that Revolut needs to serve the file directly without any redirects on either domain.
Curious to hear what Google says!
@SaintPatrck commented on GitHub (Nov 20, 2025):
Hi @samuele-ruffino96
We heard back from Google. The absence of
www.in the target website is causing a redirect. I have opened a PR that injectswww.to hopefully prevent redirects from occurring for Revolut and any other applications that do not hostassetlinks.jsonat their apex domain.Thanks again for reporting the issue and providing details.
@Raul6469 commented on GitHub (Nov 21, 2025):
Hi everyone!
May be off topic, but I'm commenting on this issue since I'm encountering the same error message in a somewhat similar situation 👀
While testing our mobile implementation of passkeys, I found out that our
app.domain.com.was not working, which is probably why I was getting the error message in Bitwarden. I guess we have to work this out and handle the fully qualified domain to fix Bitwarden compatibility?Also, on our app, we host the asset links file exclusively on
app.domain.com, and is not accessible throughwww.app.domain.com. The RP ID we use isapp.domain.com. I may be mistaken since I'm not familiar with Kotlin, but will #6183 break comptability with our app, by prefixing withwww.? Maybe this injection should only happen on apex domains likedomain.com?@SaintPatrck commented on GitHub (Nov 21, 2025):
Hi, @Raul6469.
Not off topic at all. Thank you for chiming in and pointing this out.
You're absolutely right. After taking another look at WebAuthn and Digital Asset Link specs, our strict matching was correct. I've opened a PR to revert the change.
@samuele-ruffino96 unfortunately this means Revolut, and any other applications that are misconfigured, will continue failing. I suggest reaching out to Revolut if you have not already. They will need to host their
assetlinks.jsonfile atrevolut.cominstead of redirecting towww.revolut.com. Alternatively, they can update the RP ID, but that is a destructive change I do not suggest unless no other options are available.@samuele-ruffino96 commented on GitHub (Nov 22, 2025):
Contacted Revolut via api-requests@revolut.com (the closest technical contact I've found) about this configuration issue. Will keep the thread updated on their response.
@SaintPatrck Thanks! 👍
@Raul6469 commented on GitHub (Nov 24, 2025):
Hi @SaintPatrck !
I have a last question regarding the trailing
.on digital asset link requests: is this an Android behaviour, or specific to Bitwarden?On our existing app, we already host the
assetlinks.jsonfile for other purposes than passkeys support, and according to our logs, all requests we currently receive are made without this trailing dot.When developing our passkey support, it seems like requests on
app.domain.com.are only made when trying to use a Bitwarden passkey. Also, google password manager passkeys seem to work fine, which makes me believe there is some sort of Bitwarden specific configuration 👀@SaintPatrck commented on GitHub (Dec 1, 2025):
Hi @Raul6469
Great questions!
The trailing dot is part of the error response message from Google's DAL API (see below). Google is not actually including it when fetching the asset links file, that I can tell. If they are, it's not the cause of the failure.
While using Google's DAL API to verify the calling application's authenticity is Bitwarden specific behavior, Google explicitly recommends providers perform DAL verification as part of the flow.1 Other password managers may have implemented different methods of verifying calling applications, or may not perform verification correctly or at all.
If you see Bitwarden requesting
assetlinks.jsonfromhttps://app.domain.comit is because the Relying Party ID we receive in the passkey request isapp.domain.com. Ideally, the RP ID we receive reflects the actual asset link host. That being said, I can't find anything explicitly stating we cannot discard labels from the left of the effective domain, so that may be a more robust solution that doesn't compromise security. I.e., if the RP ID isapp.domain.comwe attempt to read DAL athttps://app.domain.comfirst, thenhttps://domain.com. I will discuss that approach with the rest of the team and update this thread accordingly.DAL error response
https://developer.android.com/identity/sign-in/credential-provider - Step 6 ↩︎
@andyplop9 commented on GitHub (Dec 15, 2025):
This issue also occurs on Facebook.
@RokeJulianLockhart commented on GitHub (Dec 19, 2025):
@andyplop9, and
forkgram/TelegramAndroid/issues/360, so this issue's title should be modified.@samuele-ruffino96 commented on GitHub (Dec 24, 2025):
[UPDATE]: Response from Revolut Support Team
After reporting this issue through Revolut's in-app support, here's the response I received:
So the Revolut's team is treating this as a "future improvement" rather than a bug fix 🫤.
@SaintPatrck At this point, should this issue remain open?
@RokeJulianLockhart commented on GitHub (Dec 28, 2025):
@samuele-ruffino96, that's a matter of Revolut's first-line support not understanding that CTAP2 is an open standard. Bitwarden can special-case this, if required; there's little that needs to be done on Revolut's end, if they're not willing to. It'll merely mean that it shall take longer.
@Lord-Of-Mysteries404 commented on GitHub (Jan 1, 2026):
This happening to me on Facebook, WhatsApp, Notion and so on. This is annoying
@Lord-Of-Mysteries404 commented on GitHub (Jan 1, 2026):
This happening to me on Facebook, WhatsApp, Notion and so on. This is annoying. This issue isn't limited to US but other countries as well.
@pamperer562580892423 commented on GitHub (Jan 3, 2026):
@Lord-Of-Mysteries404:
WhatsApp is tracked in a separate issue: https://github.com/bitwarden/android/issues/5329 (and I think Notion was mentioned there as well by a BW developer)
PS: And there is another issue about "Facebook" (though mainly for the browser extensions): https://github.com/bitwarden/clients/issues/17955
@Rogerddit commented on GitHub (Feb 11, 2026):
WhatsApp case is solved in last bitwarden android app update 2026.1.1.
I hope that revolut implement the changes in their app ASAP 🙏