🐛 Bug Report: unable to register additional passkeys using KeepassXC (more than one) #138

New Issue

AtHeartEngineer · 2025-07-08T08:40:45-04:00

AtHeartEngineer commented

2025-07-08 08:40:45 -04:00

Originally created by @mihakrumpestar on 5/25/2025

Reproduction steps

Latest Pocket-id (v1.0) using Caddy reverse proxy. Configs and versions are in "Additional Information" section.

Reproducible on "demo" website (https://demo.pocket-id.org/start-demo).

Steps:

Use a new or existing account without/with passkeys (but none of them are from KeepassXC).
Register a KeepassXC passkey. (works)
Try to register second KeepassXC passkey. (fails)

Tried this in LibreWolf and Brave.

Expected behavior

It should allow registering another passkey from same provider.

Actual Behavior

KeepassXC extensions gives pop-up:

and proceeds to try my hardware FIDO2 key.

Version and Environment

Client - Browser:

KeePassXC - 2.7.10
KeePassXC-Browser - 1.9.7
Operating system: Linux x86_64
Browser: Mozilla Firefox 134.0 (Librewolf) and Brave v1.78.102

Server:

image: ghcr.io/pocket-id/pocket-id:v1.0

Reverse proxy is Caddy with the following config for headers:

	header {
		# Remove Server header (empty fingerprint signature)
		-Server
		-via

		# Permissions Policy (formerly Feature Policy)
		Permissions-Policy "interest-cohort=(), camera=(), microphone=(), geolocation=(), payment=(), usb=(), vr=()"

		# HTTP Strict Transport Security
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

		# Content Type Options
		X-Content-Type-Options "nosniff"

		# CSP header
		#Content-Security-Policy "default-src 'self'; img-src *;" # Breaks Nextcloud

		# Robots Tag
		?X-Robots-Tag "none, noindex, nofollow, nosnippet, noarchive, notranslate, noimageindex"

		# Frame Options (Clickjacking protection), SAMEORIGIN is required for FIDO2 (Vaultwarden)
		X-Frame-Options "SAMEORIGIN"

		# XSS Protection
		X-XSS-Protection "1; mode=block"

		# Referrer Policy
		Referrer-Policy "same-origin"

		# Access Control
		?Access-Control-Allow-Methods "GET, OPTIONS, PUT"
		Access-Control-Max-Age "100"

		defer
	}

Log Output

There are no errors and logs.

*Originally created by @mihakrumpestar on 5/25/2025* ### Reproduction steps Latest Pocket-id (v1.0) using Caddy reverse proxy. Configs and versions are in "Additional Information" section. Reproducible on "demo" website (https://demo.pocket-id.org/start-demo). Steps: - Use a new or existing account without/with passkeys (but none of them are from KeepassXC). - Register a KeepassXC passkey. (works) - Try to register second KeepassXC passkey. (fails) Tried this in LibreWolf and Brave. ### Expected behavior It should allow registering another passkey from same provider. ### Actual Behavior KeepassXC extensions gives pop-up: ![Image](https://github.com/user-attachments/assets/064cb16c-abb8-4c02-8b17-4d47ec593026) and proceeds to try my hardware FIDO2 key. ### Version and Environment Client - Browser: - KeePassXC - 2.7.10 - KeePassXC-Browser - 1.9.7 - Operating system: Linux x86_64 - Browser: Mozilla Firefox 134.0 (Librewolf) and Brave v1.78.102 Server: - image: ghcr.io/pocket-id/pocket-id:v1.0 - Reverse proxy is Caddy with the following config for headers: ```Caddyfile header { # Remove Server header (empty fingerprint signature) -Server -via # Permissions Policy (formerly Feature Policy) Permissions-Policy "interest-cohort=(), camera=(), microphone=(), geolocation=(), payment=(), usb=(), vr=()" # HTTP Strict Transport Security Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" # Content Type Options X-Content-Type-Options "nosniff" # CSP header #Content-Security-Policy "default-src 'self'; img-src *;" # Breaks Nextcloud # Robots Tag ?X-Robots-Tag "none, noindex, nofollow, nosnippet, noarchive, notranslate, noimageindex" # Frame Options (Clickjacking protection), SAMEORIGIN is required for FIDO2 (Vaultwarden) X-Frame-Options "SAMEORIGIN" # XSS Protection X-XSS-Protection "1; mode=block" # Referrer Policy Referrer-Policy "same-origin" # Access Control ?Access-Control-Allow-Methods "GET, OPTIONS, PUT" Access-Control-Max-Age "100" defer } ``` ### Log Output There are no errors and logs.

AtHeartEngineer closed this issue

2025-07-08 08:40:45 -04:00

AtHeartEngineer added the bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug labels 2025-07-08 08:40:46 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pocket-id#138