[GH-ISSUE #295] Wrong error message when logging in with U2F/WebAuthn key #814

Closed
opened 2026-03-14 10:43:02 +03:00 by kerem · 1 comment
Owner

Originally created by @rugk on GitHub (Jun 9, 2022).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/295

STR

  1. Setup U2F.
  2. Try a wrong i..e different U2F key to authenticate.

What happens:

An error like this is shown:

This key is already registered. It’s not necessary to register it again.

Screenshot of that, AnonAddy

What should happen

The correct message should be something like this:

This is the wrong security key. Please try again.

Seems like you improperly re-used some handling/code of adding keys – so as long as one cannot add keys in the login form, that is all hood, security-wise… 🙃

System

Linux/Fedora 36
Firefox 100

Originally created by @rugk on GitHub (Jun 9, 2022). Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/295 ## STR 1. Setup U2F. 2. Try a wrong i..e different U2F key to authenticate. ### What happens: An error like this is shown: > This key is already registered. It’s not necessary to register it again. ![Screenshot of that, AnonAddy](https://user-images.githubusercontent.com/11966684/172959478-e435bf67-c55f-4336-90b1-1dd010713b2a.png) ### What should happen The correct message should be something like this: > This is the wrong security key. Please try again. Seems like you improperly re-used some handling/code of adding keys – so as long as one cannot add keys in the login form, that is all hood, security-wise… :upside_down_face: ## System Linux/Fedora 36 Firefox 100
kerem closed this issue 2026-03-14 10:43:07 +03:00
Author
Owner

@willbrowningme commented on GitHub (Jun 16, 2022):

Thanks, I've updated it to use the errors.key_not_allowed message instead now.

<!-- gh-comment-id:1157388934 --> @willbrowningme commented on GitHub (Jun 16, 2022): Thanks, I've updated it to use the `errors.key_not_allowed` message instead now.
Sign in to join this conversation.
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/anonaddy#814
No description provided.