github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-18 03:09:11 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

[PR #1519] [MERGED] FIDO2 WebAuthn support for mobile #2938

New Issue
Closed
opened 2025-11-26 23:26:10 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-26 23:26:10 -06:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/1519
Author: @mpbw2
Created: 8/27/2021
Status: ✅ Merged
Merged: 8/30/2021
Merged by: @mpbw2

Base: master ← Head: feature-fido2webauthn

📝 Commits (2)

📊 Changes

24 files changed (+272 additions, -151 deletions)

View changed files

📝 src/Android/Services/DeviceActionService.cs (+5 -0)
📝 src/App/Abstractions/IDeviceActionService.cs (+1 -0)
📝 src/App/Pages/Accounts/LoginPage.xaml (+1 -1)
📝 src/App/Pages/Accounts/LoginPage.xaml.cs (+5 -6)
📝 src/App/Pages/Accounts/LoginPageViewModel.cs (+6 -23)
📝 src/App/Pages/Accounts/LoginSsoPageViewModel.cs (+11 -26)
📝 src/App/Pages/Accounts/RegisterPage.xaml (+1 -1)
📝 src/App/Pages/Accounts/RegisterPage.xaml.cs (+7 -1)
📝 src/App/Pages/Accounts/RegisterPageViewModel.cs (+8 -27)
📝 src/App/Pages/Accounts/TwoFactorPage.xaml (+24 -0)
📝 src/App/Pages/Accounts/TwoFactorPage.xaml.cs (+6 -2)
📝 src/App/Pages/Accounts/TwoFactorPageViewModel.cs (+80 -11)
📝 src/App/Pages/CaptchaProtectedViewModel.cs (+9 -33)
📝 src/App/Pages/Send/SendAddEditPage.xaml (+0 -4)
📝 src/App/Resources/AppResources.Designer.cs (+30 -2)
📝 src/App/Resources/AppResources.resx (+15 -0)
📝 src/App/Services/MobilePlatformUtilsService.cs (+2 -2)
📝 src/App/Utilities/AppHelpers.cs (+15 -0)
📝 src/Core/Abstractions/IAuthService.cs (+1 -1)
📝 src/Core/Abstractions/IPlatformUtilsService.cs (+1 -1)

...and 4 more files

📄 Description

Support for FIDO2 WebAuthn in iOS & Android. Since iOS only supports FIDO2 via Safari, the decision was made to ditch the native API in Android and use a single code path for both platforms (using WebAuthenticator; I'll push the native API work to a separate branch in case we ever want to revisit). This has the added benefit of not excluding our F-Droid users since the native API is part of Google Play Services, as well as being able to ship this ASAP without waiting for these changes to make it into production.

Additional changes: Reworked the method of showing the progress dialog/spinner during use of WebAuthenticator based on issues discovered while working on FIDO that I inadvertently avoided while working on SSO. Brought these changes to captcha as well to smooth out the flow.

Also discovered the latest version of WebAuthenticator supports ephemeral webviews on iOS which has the additional side-effect of not prompting to open the view, so I applied this to both WebAuthn & captcha to smooth out the experience (left in place for SSO because of our use of cookies across sessions).

Tested with a YubiKey 5C NFC & 5Ci, which covers NFC, USB-C, and Lightning.

Notes on NFC: This process is clumsy on Android due to the speed of the handoff to the default scan handler after the FIDO2 scan is complete, combined with the way the system treats impromptu scans. If you don't physically distance the key soon enough after the FIDO2 scan the default handler scans it again and opens a web browser showing a Yubico page. You can time it with the device vibrations to get a perfect scan - a successful WebAuthn scan will result in 2 distinct vibrations. If you feel a 3rd one, you waited too long. And if you only feel 1, you pulled away too soon and the scan will fail with an error. (For the record this happens with the native FIDO2 API as well). Technically iOS does this as well but they trigger a notification instead of opening a browser, so the user doesn't have to worry about their reflexes during login.

Edit: Forgot to mention some UI work is still needed for the mobile webauthn-connector:

android

iOS

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/1519 **Author:** [@mpbw2](https://github.com/mpbw2) **Created:** 8/27/2021 **Status:** ✅ Merged **Merged:** 8/30/2021 **Merged by:** [@mpbw2](https://github.com/mpbw2) **Base:** `master` ← **Head:** `feature-fido2webauthn` --- ### 📝 Commits (2) - [`9711b20`](https://github.com/bitwarden/android/commit/9711b203374d8be13e7276167e9cdfef04c782de) FIDO2 / WebAuthn support for mobile - [`1ab7fd6`](https://github.com/bitwarden/android/commit/1ab7fd61c9d965064df9811fbc08a64758f93be6) fixes ### 📊 Changes **24 files changed** (+272 additions, -151 deletions) <details> <summary>View changed files</summary> 📝 `src/Android/Services/DeviceActionService.cs` (+5 -0) 📝 `src/App/Abstractions/IDeviceActionService.cs` (+1 -0) 📝 `src/App/Pages/Accounts/LoginPage.xaml` (+1 -1) 📝 `src/App/Pages/Accounts/LoginPage.xaml.cs` (+5 -6) 📝 `src/App/Pages/Accounts/LoginPageViewModel.cs` (+6 -23) 📝 `src/App/Pages/Accounts/LoginSsoPageViewModel.cs` (+11 -26) 📝 `src/App/Pages/Accounts/RegisterPage.xaml` (+1 -1) 📝 `src/App/Pages/Accounts/RegisterPage.xaml.cs` (+7 -1) 📝 `src/App/Pages/Accounts/RegisterPageViewModel.cs` (+8 -27) 📝 `src/App/Pages/Accounts/TwoFactorPage.xaml` (+24 -0) 📝 `src/App/Pages/Accounts/TwoFactorPage.xaml.cs` (+6 -2) 📝 `src/App/Pages/Accounts/TwoFactorPageViewModel.cs` (+80 -11) 📝 `src/App/Pages/CaptchaProtectedViewModel.cs` (+9 -33) 📝 `src/App/Pages/Send/SendAddEditPage.xaml` (+0 -4) 📝 `src/App/Resources/AppResources.Designer.cs` (+30 -2) 📝 `src/App/Resources/AppResources.resx` (+15 -0) 📝 `src/App/Services/MobilePlatformUtilsService.cs` (+2 -2) 📝 `src/App/Utilities/AppHelpers.cs` (+15 -0) 📝 `src/Core/Abstractions/IAuthService.cs` (+1 -1) 📝 `src/Core/Abstractions/IPlatformUtilsService.cs` (+1 -1) _...and 4 more files_ </details> ### 📄 Description Support for FIDO2 WebAuthn in iOS & Android. Since iOS only supports FIDO2 via Safari, the decision was made to ditch the native API in Android and use a single code path for both platforms (using `WebAuthenticator`; I'll push the native API work to a separate branch in case we ever want to revisit). This has the added benefit of not excluding our F-Droid users since the native API is part of Google Play Services, as well as being able to ship this ASAP without waiting for [these changes](https://github.com/passwordless-lib/fido2-net-lib/pull/237) to make it into production. Additional changes: Reworked the method of showing the progress dialog/spinner during use of `WebAuthenticator` based on issues discovered while working on FIDO that I inadvertently avoided while working on SSO. Brought these changes to captcha as well to smooth out the flow. Also discovered the latest version of WebAuthenticator supports ephemeral webviews on iOS which has the additional side-effect of _not_ prompting to open the view, so I applied this to both WebAuthn & captcha to smooth out the experience (left in place for SSO because of our use of cookies across sessions). Tested with a YubiKey 5C NFC & 5Ci, which covers NFC, USB-C, and Lightning. Notes on NFC: This process is clumsy on Android due to the speed of the handoff to the default scan handler after the FIDO2 scan is complete, combined with the way the system treats impromptu scans. If you don't physically distance the key soon enough after the FIDO2 scan the default handler scans it again and opens a web browser showing a Yubico page. You can time it with the device vibrations to get a perfect scan - a successful WebAuthn scan will result in 2 distinct vibrations. If you feel a 3rd one, you waited too long. And if you only feel 1, you pulled away too soon and the scan will fail with an error. (For the record this happens with the native FIDO2 API as well). Technically iOS does this as well but they trigger a notification instead of opening a browser, so the user doesn't have to worry about their reflexes during login. Edit: Forgot to mention some UI work is still needed for the mobile webauthn-connector: ![android](https://user-images.githubusercontent.com/59324545/131186042-c967a8da-551b-4735-a452-9daf9141d851.png) ![iOS](https://user-images.githubusercontent.com/59324545/131186049-5b40bd3f-bdb4-48ae-8828-2ad154074cd2.png) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2025-11-26 23:26:10 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#2938
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?