I have registered (token2) hardware fido keys, but the user still can use just username+password to login. It should be possible to disable password login as soon as security keys do exist.
Environment
OS Type & Version: docker
Pangolin Version: 1.17.0
Gerbil Version: 1.3.1
To Reproduce
Add a security key (no MFA) and try to login just with password -> still possible. So no added security by the security keys.
Expected Behavior
Login with username+password should not be possible if security keys are registered.
Originally created by @kosli on GitHub (Apr 11, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2829
### Describe the Bug
I have registered (token2) hardware fido keys, but the user still can use just username+password to login. It should be possible to disable password login as soon as security keys do exist.
### Environment
- OS Type & Version: docker
- Pangolin Version: 1.17.0
- Gerbil Version: 1.3.1
### To Reproduce
Add a security key (no MFA) and try to login just with password -> still possible. So no added security by the security keys.
### Expected Behavior
Login with username+password should not be possible if security keys are registered.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @kosli on GitHub (Apr 11, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2829
Describe the Bug
I have registered (token2) hardware fido keys, but the user still can use just username+password to login. It should be possible to disable password login as soon as security keys do exist.
Environment
To Reproduce
Add a security key (no MFA) and try to login just with password -> still possible. So no added security by the security keys.
Expected Behavior
Login with username+password should not be possible if security keys are registered.