mirror of
https://github.com/bitwarden/android.git
synced 2026-03-21 22:00:42 -05:00
Android O: Autofill API #40
Closed
opened 2025-11-07 08:24:08 -06:00 by GiteaMirror
·
69 comments
No Branch/Tag Specified
main
crowdin-pull
sdlc/sdk-update
llm/skill-refinements
release/2026.3-rc49
PM-24380/flight-recorder-redact-hostname
sdk-folder-repo-interface
PM-25654-preview-attachment
android-collections
cx/android-architect-agent
PM-30130-remove-archive-feature-flag
llm/add-resolving-sdk-updates-skill
QA-1523/sanity-test-saucelabs
release/2026.3-rc48
PM-26577-app-links-support
PM-26896-autofill-fix
release/2026.2-rc47
PM-32714/fallback-to-web-vault-host
pr-6572
PM-28834/setting-app-layout-horizonos
release/2026.2-rc46
release/2026.1-rc45
PM-30644/added-logs-for-debug
PM-30644/quicktile-nav-not-showing-migration
minor-gradle-updates
release/2026.1-rc42
release/2026.1-rc44
release/2026.1-rc43
PM-28834/set-landscape-on-horizonos-devices
context-rules
devclarity/update-code-review-command
PM-20026/force-ltr-passwords-and-codes
release/2025.12-rc41
cmcg/testCoverage
PM-29014/talkback-support-for-passwords
release/2025.12-rc40
BRE-1305/publish_test
accept-user-certs
autofill-permissions
release/2025.11-rc39
PM-22479/check-all-certificates-validate-asset-links
release/2025.10-rc38
agalles/android-latest
optimize-test-workflows
tier2-test-sharding
retro-agent
PM-27001/skip-account-selection-only-one-exists-cxp
release/2025.10-rc37
agalles/test-1118
release/2025.10-rc36
PM-20593-token-refresh
QA-1126b/adding-native-sanity-test
release/2025.9-rc35
pm-25933/sdk-update-password
release/2025.9-rc34
release/2025.8-rc33
agalles/20250821-release
debug-release-issues
pm-24249-allow-automated-prs-for-sdk-updates
release/2025.8-rc32
release/WORKFLOW-TEST-2025.8-rc28
agalles/20250807release
release/2025.07-rc25
release/hotfix-v2025.7.0-bwa
pm-23311/export-vault-policy-bypass
release/2025.07-rc24
authenticator-pm-sync-flags-issue
ps/implement-sdk-repository-example
release/hotfix-v2025.6.0-bwpm
release/2025.06-rc21
agalles/automate-android-fastlane-patch
release/2025.05-rc20
release/2025.04-rc19
languages/basque
release/2025.03-rc19
update-readme
qrcode/feature
innovation/archive/pm-19153-archive-items
qrcode/2-ui-fields
qrcode/1-page
hold-on-biometric-prompt-alternative
release-notes-process
release/2025.02-rc16
bwa-monorepo
PM-8223/new-device-verification-ux-improvements
pm-18451/exempt-from-policies
test-bwa
cs-workaround-linked-0-copy
release/2025.01-rc15
release/2025.01-rc14
release/2024.12-rc13
pm-16670/sync-leave-notice
821
PM-16695/backport-lean-more-new-device-verification
km/15084-testing
release/hotfix-v2024.11.7
release/2024.11-rc1
pm-11304/collection-add-item-button
PM-14241/disabling-logs-app-crash
poc/offline-editing
new-version-calc
pm-11649/expired-link-services
pm-6702/add-feature-flag
pm-6702/email-verification-feature
pm-9933/marketing-copy-update
pm-6702/registration-flows
update-templates
pm-6701/email-verification-selfhost-registration
v2026.3.0-bwpm
v2026.3.0-bwa
v2026.2.1-bwpm
v2026.2.1-bwa
v2026.2.0-bwpm
v2026.2.0-bwa
v2026.1.1-bwa
v2026.1.1-bwpm
temp-test
v2026.1.0-bwpm
v2026.1.0-bwa
v2025.12.1-bwa
v2025.12.1-bwpm
v2025.12.0-bwa
v2025.12.0-bwpm
v2025.11.1-bwpm
v2025.11.1-bwa
v2025.11.0-bwpm
v2025.11.0-bwa
v2025.10.1-bwa
v2025.10.1-bwpm
v2025.10.0-bwa
v2025.10.0-bwpm
v2025.9.1-bwa
v2025.9.1-bwpm
v2025.9.0-bwa
v2025.9.0-bwpm
v2025.8.1-bwa
v2025.8.1-bwpm
v2025.8.0-bwa
v2025.8.0-bwpm
v2025.7.2-bwa
v2025.7.2-bwpm
v2025.7.1-bwa
v2025.7.1-bwpm
v2025.7.0-bwa
v2025.7.0-bwpm
v2025.6.1-bwpm
v2025.6.0-bwa
v2025.6.0-bwpm
v2025.1.0-bwa
v2025.5.0-bwa
v2025.5.0-bwpm
v2025.5.999
2025.4.0
v2025.4.0
untagged-4731eaadac73f3dfbbb8
v2025.3.0
v2025.2.0
untagged-815a165c5d70ffe75bc7
v2025.1.2
v2025.1.1
v2025.1.0
v2024.12.0
untagged-5a76b6392a4c8998c63a
v2024.11.7
v2024.11.6
v2024.11.5
v2024.11.4
v2024.11.3
v2024.11.2
v2024.11.1
v2024.11.0
v2024.10.2
v2024.10.1
v2024.10.0
v2024.9.0
v2024.8.1
v2024.8.0
v2024.7.3
v2024.7.2
v2024.7.1
v2024.7.0
v2024.6.1
v2024.6.0
v2024.5.1
v2024.4.1
v2024.4.2
v2024.4.0
v2024.3.3
v2024.3.1
v2024.3.0
v2024.2.1
v2024.2.0
v2024.1.1
v2024.1.0
v2023.12.0
v2023.10.0
v2023.9.2
maui-single-project-android
v2023.9.1
v2023.9.0
v2023.8.0
v2023.7.0
v2023.5.0
v2023.4.0
v2023.3.2
v2023.3.1
v2023.3.0
v2023.2.0
v2023.1.0
v2022.11.0
v2022.10.0
v2022.9.1
v2022.9.0
v2022.8.0
v2022.6.2
v2022.6.1
v2022.6.0
v2022.05.0
v2.18.0
v2.17.0
v2.16.4
v2.16.3
v2.16.2
v2.16.1
v2.15.0
v2.14.2
v2.14.1
v2.14.0
v2.13.0
v2.12.0
v2.11.3
v2.11.2
v2.11.1
v2.11.0
v2.10.0
v2.9.1
v2.9.0
v2.8.2
v2.8.1
v2.8.0
v2.7.2
v2.7.0
v2.6.1
v2.6.0
v2.5.6
v.2.5.5
v2.5.5
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5.0
v2.4.3
v2.4.2
v2.4.1
v2.4.0
v2.3.1
v2.3.0
v2.2.8
v2.2.7
v2.2.6
v2.2.2
v2.2.1
v2.2.0
v2.1.2
v2.1.0
v2.0.6
v2.0.5
v2.0.4
v2.0.3
v2.0.2
v2.0.1
v2.0.0
v1.22.1
v1.22.0
v1.21.0
v1.20.0
v1.19.0
v1.18.1
v1.18.0
v1.17.0
v1.16.0
v1.15.2
v1.15.1
v1.15.0
v1.14.4
v1.14.1
v1.14.0
v1.13.0
v1.12.2
v1.12.1
v1.12.0
v1.11.1
v1.11.0
v1.10.0
v1.9.0
v1.8.1
v1.8.0
v1.7.0
v1.6.5
v1.6.1
v1.6.0
v1.5.1
v1.5.0
v1.4.4
v1.4.3
v1.4.0
v1.3.0
v1.2.1
v1.2.0
v1.1.0
v1.0.0
v0.0.6
v0.0.5
v0.0.4
v0.0.3
v0.0.2
v0.0.1
No Label
enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/android#40
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nogweii on GitHub (Apr 11, 2017).
Hooray, Android is getting proper support for password management apps!
https://developer.android.com/preview/features/autofill.html
Currently only available in beta builds of Android O, for very specific Google devices. It'll be quite a while before we see phones actually running whatever the next dessert will be called, so the accessibility service will stick around.
@kspearrin commented on GitHub (Apr 11, 2017):
Yes, we plan to add support for this as soon as the API is available in Xamarin.Android.
@carlylemiii commented on GitHub (Aug 8, 2017):
Android O is likely to drop within a week or two. Any updated plans on this?
@kspearrin commented on GitHub (Aug 8, 2017):
Looks like there is some support being added to
Xamarin.Androidrecently. I'll start looking into it more now but don't expect something to be available as soon as O lands.@wjbeckett commented on GitHub (Aug 22, 2017):
Looking forward to this!
@kspearrin commented on GitHub (Aug 23, 2017):
Xamarin will have official Android 8.0 support in v15.4, so we're waiting on that before we start working on this.
@nicosemp commented on GitHub (Sep 15, 2017):
@kspearrin This article was recently posted on developer.xamarin.com.
Can't wait for this to happen!
@kspearrin commented on GitHub (Sep 15, 2017):
@nicosemp Yep, I've been trying to get 15.4 preview 2 working but am having a hard time with it...
@kspearrin commented on GitHub (Sep 15, 2017):
Blocked by this issue: https://bugzilla.xamarin.com/show_bug.cgi?id=56740
Looks like I'll have to wait for preview 3
@kspearrin commented on GitHub (Sep 16, 2017):
Got around the blocker and started working on this in the
autofillbranch. https://github.com/bitwarden/mobile/tree/autofillCheck out this quick demo :)
@geransmith commented on GitHub (Sep 27, 2017):
@kspearein I'd love to help test on Android. You should setup a beta channel if you haven't already.
@Zer0t3ch commented on GitHub (Oct 11, 2017):
I'm running O on my Nexus 6P, as well. Would be happy to test this if/when it ends up in a beta branch I can install without having to compile myself.
@anortiz08 commented on GitHub (Oct 15, 2017):
Running Android O on OnePlus 3 OxygenOS, more than willing to test!
@Moxville commented on GitHub (Oct 16, 2017):
Password Managers using Android Oreo’s Autofill API are Potentially Vulnerable to Data Leakage
https://www.xda-developers.com/password-manager-autofill-api-data-leak/
https://github.com/commonsguy/AutofillFollies/blob/master/WHITE_PAPER.md
Just sharing the links.
@geransmith commented on GitHub (Oct 16, 2017):
@Moxville I feel like that is a moot point. It assumes a malicious app on the phone. If you have a malicious app, you can pretty easily get someone to put info in there.
@nicosemp commented on GitHub (Oct 16, 2017):
@tehspaceg That's true, but it's still good to take some precautions where possible. Like partitioning data, and checking that the app that's being filled is actually the one associated with the entry, as the article suggests.
EDIT: Also it might be wise to wait for "best practices" from Google.
@JaceHensley commented on GitHub (Oct 24, 2017):
Wouldn't best practices be to use the APIs provided by Google?
@kspearrin commented on GitHub (Oct 24, 2017):
@JaceHensley We do use the APIs provided by Google. Just the C# version of them.
15.4 is now available for Xamarin, so we'll start looking at this again hopefully sometime soon.
@NanoSector commented on GitHub (Nov 14, 2017):
Any updates on this? It seems Xamarin has released sample code how to handle this: https://developer.xamarin.com/samples/monodroid/android-o/AutofillFramework/
@kspearrin commented on GitHub (Nov 14, 2017):
Yes, we are beginning to work on this again now.
@vinimk commented on GitHub (Nov 15, 2017):
can I help with this? is there a specific branch where things are being done? I saw a branch but it got the last commit 2 months ago so i'm not sure
@kspearrin commented on GitHub (Nov 15, 2017):
I merged that branch into master and starting working on it more.
See https://github.com/bitwarden/mobile/tree/master/src/Android/Autofill
Feel free to stop by our Gitter channel if you want to discuss specifics of how you can contribute to this feature.
@kspearrin commented on GitHub (Nov 17, 2017):
I've made significant progress on this task over the past 2 days. Most of the work is now done. Expect a beta test next week.
@kspearrin commented on GitHub (Nov 21, 2017):
This is now live through our beta channel on the play store. Please post any feedback or problems in this issue. Blog post: https://blog.bitwarden.com/bitwarden-the-oreo-autofill-framework-2a8b2e04f29e
@wjbeckett commented on GitHub (Nov 21, 2017):
With the latest update, When BitWarden is trying to fill a form, my default notification sound is firing constantly.
I can reproduce it every single time. Regardless of whether BitWarden is my autofill or not.
@kspearrin commented on GitHub (Nov 21, 2017):
@wjbeckett Are you also using the autofill accessibility service? Sounds odd since our autofill framework implementation does nothing with notifications.
@wjbeckett commented on GitHub (Nov 21, 2017):
@kspearrin ah. yes that's what is doing it.
Disable the accessibility service, and it stops.
I suppose I should log a bug for this then? Happening in all apps and Chrome.
@kspearrin commented on GitHub (Nov 21, 2017):
@wjbeckett I just reproduced it on my end here as well. I'll look into a fix. No need for a new issue.
@wjbeckett commented on GitHub (Nov 21, 2017):
@kspearrin Perfect! Thanks mate.
@wjbeckett commented on GitHub (Nov 21, 2017):
@kspearrin Also seeing that when trying to Autofill in the PayPal app, the BitWarden autofill form appears, I tap it, unlock my vault, select the entry I want to autofill with, and then nothing happens. It doesn't fill in the username/password fields.
@kspearrin commented on GitHub (Nov 21, 2017):
@wjbeckett I see. Not sure why this is only happening with PayPal app. Will have to investigate more. Unlocked vault can still fill it correctly.
@kspearrin commented on GitHub (Nov 21, 2017):
@wjbeckett I just tested it and it looks like everything is being done correctly to perform the autofill, but it just doesn't work with that app. Additionally, I even tried 1Password and LastPass apps and they do not autofill with PayPal correctly either. 🤷♂️
@ragingsheep commented on GitHub (Nov 21, 2017):
Do you guys know how 1Password is doing auto-fill within Chrome?
@kspearrin commented on GitHub (Nov 22, 2017):
I’m using 1password on my Nexus 5X with android 8.0 and the autofill service doesn’t work in chrome at all...??
@ragingsheep commented on GitHub (Nov 22, 2017):
I'm on Pixel 2 XL with 8.0 with Chrome 62.0.3202.84 and 1Password 6.7.BETA-3.
Only noticed it appearing around a week ago.
@kspearrin commented on GitHub (Nov 22, 2017):
@ragingsheep
I am running the exact same versions and do not see it working on a few websites that I have tried. Can you give me an example website that it works on?
@ragingsheep commented on GitHub (Nov 22, 2017):
Actually, I think they might be "faking it", do you have Accessibility turned on for 1Password? It doesn't "autofill" in Chrome if I turn that off but it still autofills in apps.
@kspearrin commented on GitHub (Nov 22, 2017):
@ragingsheep Yes, that is their accessibility service doing it in Chrome. Their UX is just the same on both methods.
@hrach commented on GitHub (Nov 22, 2017):
Great work! Is there any possibility to save the matching mobile app to the entry? Not to search correct entry everytime. LastPass was doing something like this... :-)
@kspearrin commented on GitHub (Nov 22, 2017):
@hrach Not sure what you mean. When you save a new login it should use the mobile app's package name.
@geransmith commented on GitHub (Nov 22, 2017):
I think he means if you saved a site in the web browser, it uses url. The
search appears to do pattern matching. Maybe when an item in the mobile app
is identified for autofill, add a field automatically (or prompt to do so)
that contains the package name.
On Wed, Nov 22, 2017, 8:14 AM Kyle Spearrin notifications@github.com
wrote:
--
-Geran
@kspearrin commented on GitHub (Nov 22, 2017):
I see, yes, there is room for improvement there which has been the case for autofilling on android for some time now.
@IOI-655321 commented on GitHub (Nov 24, 2017):
Implementation works well in most cases a few issues I've found not sure if these are specific to Bitwarden or not:
Google Find Devices (Device manager) doesn't prompt autofill
Amazon Shopping app log in doesn't prompt auto fill
Twitter and some other apps working fine so great job getting this out. Way better than lastpass buggy separate app version i tested a while back.
Samsung Galaxy S8 Oreo beta 3
@geransmith commented on GitHub (Nov 24, 2017):
I suspect the main limitation is in those apps. I'm fairly certain
bitwarden is just calling the API, if the target app doesn't work with the
API, it won't work.
On Fri, Nov 24, 2017, 10:19 AM BigNickBurgess notifications@github.com
wrote:
--
-Geran
@kspearrin commented on GitHub (Nov 24, 2017):
Some apps use web views for their login forms. I don't think these work with the Autofill Framework yet. I know Amazon is one I tested.
@hrach commented on GitHub (Nov 24, 2017):
@kspearrin I mean a situation when the app package name doesn't match the domain, or there is some SSO which I'd like to attach to the app.
Also, I've encountered a bug, when I click an input, it prints the vault is locked. When unlocked, I've returned to the app, but the input shows still the same message that vault is locked.
Third, It also suggest something in my (Nova) launcher search field - is there any way how not to show it here?
@kspearrin commented on GitHub (Nov 24, 2017):
@hrach
@hrach commented on GitHub (Nov 24, 2017):
@kspearrin commented on GitHub (Nov 24, 2017):
@hrach If you are unlocking you must select the item to fill from the app UI. If you just press back you will end up with nothing if the app immediately locks back again. That is expected.
@hrach commented on GitHub (Nov 24, 2017):
If I open the Bitwarden app (after pressing back, leaving my app and launching Bitwarden), it isn't locked. That's the reason why I was confused.
@kspearrin commented on GitHub (Nov 24, 2017):
Ok, what is your lock option set at?
@hrach commented on GitHub (Nov 24, 2017):
These two:
@IOI-655321 commented on GitHub (Nov 24, 2017):
If you go to 'features' you still have to have always scan/scan when password field focused/persist notification selected. Does this affect battery or anything when Oreo autofill is enabled? Can these be disabled when Oreo autofill active or can the accessibility and oreo autofill api be run simultaneously?
Similarly the Tools panel for the accessibility auto fill service should be disabled and maybe a new one added to take you to the Oreo autofill panel.
@kspearrin commented on GitHub (Nov 24, 2017):
@BigNickBurgess Yes, we still have some work to do on the settings pages. All settings only apply to the accessibility service today. They can be run at the same time if you like.
@anortiz08 commented on GitHub (Nov 24, 2017):
@kspearrin For #3 above, anyway the exclusion list can be managed by the user. Maybe when the auto fill overlay is presented, an option to add to the exclusion list?
@kspearrin commented on GitHub (Nov 24, 2017):
The overlay UI is not really configurable in that way. If the exclusion list is growing large then it sounds like I have some flaws in my field detection logic that needs to be revisited. Do you have other app examples that are presenting the overlay that should not be?
@pdf commented on GitHub (Nov 24, 2017):
@kspearrin I think @anortiz08 is trying to solve a problem that would be better served by logic whereby if autofill is triggered, the accessibility overlay should not also pop, when they're both enabled. I suspect this is non-trivial though.
@kspearrin commented on GitHub (Nov 25, 2017):
@pdf Yea, I am not sure how we could support that.
@pdf commented on GitHub (Nov 25, 2017):
Off the top of my head, only way I can think would be to add a small delay to the accessibility pop when they're both enabled, set a var against the app id if the autofill is triggered, check that at timeout on the accessibility pop to determine whether to actually pop the accessibility overlay. This would be racey, but probably works most of the time.
Thinking about it further, using the exclusion list (or a separate internal list) to track apps when autofill is successfully triggered would allow preventing future accessibility pops for that app. This could be combined with the above strategy, or could be used to cause the first accessibility overlay to close, though the latter would be a little janky, it would only happen once per app.
@anortiz08 commented on GitHub (Nov 26, 2017):
@kspearrin Thus far I have noticed the auto fill overlay appearing in YouTube search and Nine email client when entering a pin.
@Moxville commented on GitHub (Nov 26, 2017):
Getting your Android app ready for Autofill
https://android-developers.googleblog.com/2017/11/getting-your-android-app-ready-for.html
@kspearrin commented on GitHub (Nov 26, 2017):
@Moxville Yes, we already contacted Google through that form... and no reply :-/
@kspearrin commented on GitHub (Nov 26, 2017):
@anortiz08 For some reason the Youtube Search input field has a "input type" of
TextVariationPasswordtells me that it is a password field. Not sure why it is marked this way...@kspearrin commented on GitHub (Nov 27, 2017):
@hrach I installed Nova launcher and the Google search field doesn't seem to suggest an autofill it in my tests?
@hrach commented on GitHub (Nov 27, 2017):
@kspearrin weird. It autosuggests also in search field of Google's contacts app. I have One Plus, so the Android is not "clean"… can I help you somehow?
@kspearrin commented on GitHub (Nov 27, 2017):
Yes, all of these fields are marked with input type
TextVariationPasswordfor some reason. I have added a check in the next version to filter out any fields with "Search" in them.@kspearrin commented on GitHub (Nov 28, 2017):
I just published build 1106 to the beta channel with more fixes and improvements.
@kspearrin commented on GitHub (Dec 6, 2017):
This is now rolling out to production.
@edvorg commented on GitHub (Dec 7, 2017):
Could you please update here when the app with this feature is in play
store?
@IOI-655321 commented on GitHub (Dec 7, 2017):
It was released to the stable branch when he posted yesterday I believe.
If you view the 'autofill' screen in tools the links now go to the autofill API screen as well as the Accessibility version.