Adding passkey not explained well #14747

New Issue

GiteaMirror · 2025-11-02T11:21:53-06:00

GiteaMirror commented

2025-11-02 11:21:53 -06:00

Originally created by @PaulBol on GitHub (Jul 11, 2025).

Description

On the login page we have a link Sign in with a passkey.

How do we add a passkey for signing in with it?

One can expect the user to go to Settings > Security.

Here the user can see the section Two-Factor Authentication (Security Keys) with the button Add Security Key and this text

Security keys are hardware devices containing cryptographic keys. They can be used for two-factor authentication. Security keys must support the WebAuthn Authenticator standard.

Knowledgeable users will immediately understand that these security keys are the same thing as the passkey mentioned on the login page. However, not everyone is so clever which includes myself.

I think that the names should be aligned. Or at least mention on the settings page that a security key is a passkey.

Screenshots

is configured by

Passkey = Security Key – but that's not spelled out.

Gitea Version

1.24.2

Can you reproduce the bug on the Gitea demo site?

Yes

Operating System

n/a

Browser Version

n/a

Originally created by @PaulBol on GitHub (Jul 11, 2025). ### Description On the login page we have a link **Sign in with a passkey**. How do we add a passkey for signing in with it? One can expect the user to go to Settings > Security. Here the user can see the section **Two-Factor Authentication (Security Keys)** with the button **Add Security Key** and this text > Security keys are hardware devices containing cryptographic keys. They can be used for two-factor authentication. Security keys must support the [WebAuthn Authenticator](https://w3c.github.io/webauthn/#webauthn-authenticator) standard. Knowledgeable users will immediately understand that these security keys are the same thing as the passkey mentioned on the login page. However, not everyone is so clever which includes myself. I think that the names should be aligned. Or at least mention on the settings page that a security key is a passkey. ### Screenshots <img width="499" height="48" alt="Image" src="https://github.com/user-attachments/assets/fbba69f7-ebde-470a-91ab-60dae52ae9f0" /> is configured by <img width="1037" height="287" alt="Image" src="https://github.com/user-attachments/assets/323cd0f2-f8bf-4ccb-b3c2-a9d60a0ce0a7" /> Passkey = Security Key – but that's not spelled out. ### Gitea Version 1.24.2 ### Can you reproduce the bug on the Gitea demo site? Yes ### Operating System n/a ### Browser Version n/a

GiteaMirror added the topic/ui type/bug labels 2025-11-02 11:21:53 -06:00

GiteaMirror commented

2025-11-02 11:21:54 -06:00

@wxiaoguang commented on GitHub (Jul 11, 2025):

Related to Add Passkey login support #31504

@anbraten do you have some ideas about this issue?

I also have a question: it seems that WebAuthn is used for 2FA(MFA) and Passkey login at the same time, do we need to improve the design?

@wxiaoguang commented on GitHub (Jul 11, 2025): Related to Add Passkey login support #31504 @anbraten do you have some ideas about this issue? I also have a question: it seems that WebAuthn is used for 2FA(MFA) and Passkey login at the same time, do we need to improve the design?

GiteaMirror commented

2025-11-02 11:21:54 -06:00

@sionicion commented on GitHub (Oct 26, 2025):

Yeah it doesn't make sense, I was hesitant to add a key because I thought it wasn't the right thing (multi-factor not single-factor). And now after adding one and sign in with passkey works, I went to try signing in with my password and then it requires the passkey, which seems silly because you might as well skip that step and just directly sign in with a passkey. I think the verbiage should be updated so you can add a passkey but in another section below it, decide whether you want to use it as SFA or MFA (also something that should probably be enforceable in app.ini).

@sionicion commented on GitHub (Oct 26, 2025): Yeah it doesn't make sense, I was hesitant to add a key because I thought it wasn't the right thing (multi-factor not single-factor). And now after adding one and sign in with passkey works, I went to try signing in with my password and then it requires the passkey, which seems silly because you might as well skip that step and just directly sign in with a passkey. I think the verbiage should be updated so you can add a passkey but in another section below it, decide whether you want to use it as SFA or MFA (also something that should probably be enforceable in app.ini).

GiteaMirror commented

2025-11-02 11:21:54 -06:00

@sionicion commented on GitHub (Oct 26, 2025):

Oh another thing, I kept having to sign back in and was confused why, it's because "Remember This Device" doesn't work when signing in with a passkey as SFA. You have to sign in with your password and check "Remember This Device", then it prompts for the passkey, once you're signed in, you'll have the "gitea_incredible" cookie. But again, that's if you do sign in using MFA or just use a password in general. If you click sign in with passkey, it disregards the checkbox for "Remember This Device".

@sionicion commented on GitHub (Oct 26, 2025): Oh another thing, I kept having to sign back in and was confused why, it's because "Remember This Device" doesn't work when signing in with a passkey as SFA. You have to sign in with your password and check "Remember This Device", then it prompts for the passkey, once you're signed in, you'll have the "gitea_incredible" cookie. But again, that's if you do sign in using MFA or just use a password in general. If you click sign in with passkey, it disregards the checkbox for "Remember This Device".

GiteaMirror commented

2025-11-02 11:21:55 -06:00

@anbraten commented on GitHub (Oct 27, 2025):

I also have a question: it seems that WebAuthn is used for 2FA(MFA) and Passkey login at the same time, do we need to improve the design?

Yes the design needs to be improve. At it is as @sionicion described used as MFA and passkey SFA.

@anbraten commented on GitHub (Oct 27, 2025): > I also have a question: it seems that WebAuthn is used for 2FA(MFA) and Passkey login at the same time, do we need to improve the design? Yes the design needs to be improve. At it is as @sionicion described used as MFA and passkey SFA.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14747