AllBugsFeaturesChangelogBountiesSearchNew post
Sign in with Fluxer
Bugs

cannot log into feedback site after migrating passkey

(#4574) Bug Open: Confirmed Priority: P1 api feedback-site migration security
by sodiboo edited

Reproduction steps

-1. have a passkey on your account. moreover, make sure this is the only "second" factor attached to that account.
  1. open web.fluxer.app as normal today, migrate to the new fluxer.com app domain, and also migrate your passkey
    • the passkey is now bound to fluxer.com
  2. get mysteriously logged out of feedback.fluxer.com (or log out manually)
  3. try to log in to feedback.fluxer.com

Expected behaviour

i should be presented with a login prompt that accepts a fluxer.com passkey

Actual behaviour

i am presented with a login prompt that does not accept my fluxer.com passkey. i am therefore unable to log into the feedback site, and as such, it is entirely impossible to report this bug.

Build information

Fluxer Feedback 2026.1029.140415, Firefox 157 on Linux

Platform

Web, API, feedback.fluxer.com

fluxer-feedback-no-passkey-allowed.webm | 410 kB Link to fluxer-feedback-no-passkey-allowed.webm
  1. Fullest changed the status from Needs triage to Confirmed

Merged posts

These posts were merged into this one. Their comments are now part of the conversation below, marked with where they came from.

Merged from #4607 Sign-in uses fluxer.app, so passkeys saved for fluxer.com are not offered

⦓⡷⠂NEONSY⠐⢾⦔

Report details

Reproduction steps

  1. Have a passkey for your Fluxer account saved for fluxer.com, for example in Proton Pass
  2. Sign out of feedback.fluxer.com and start signing in again
  3. Sign-in happens on fluxer.app
  4. Choose to sign in with a passkey

Expected behaviour

The saved fluxer.com passkey is offered, since Fluxer's web app is now on fluxer.com

Actual behaviour

No passkey is offered, so you have to sign in another way. Passkeys only work on the domain they were saved for, so a passkey saved for fluxer.com is not offered on fluxer.app. Seen with Proton Pass

Build information

Fluxer Feedback 2026.1029.140415, Chrome 156 on Windows

Platform

feedback.fluxer.com

Evidence

Fluxer's instance info at https://fluxer.app/.well-known/fluxer lists the web app as https://fluxer.com, so passkeys made in the web app now belong to fluxer.com, while this site's sign-in still uses fluxer.app Possible fixes: Sign in through fluxer.com, or let fluxer.app accept fluxer.com passkeys with WebAuthn Related Origin Requests (a /.well-known/webauthn file on fluxer.com that lists fluxer.app)

8 comments

Sign in with Fluxer to comment and vote.
Comment by Fullest
FullestReviewer 1 vote Merged from #4607 4 replies
Status changed from Needs triage to Answered
Hey there, there exists a passkey migration flow, but it may not be obvious how to get it to trigger. I'm not sure exactly how it will manifest with Proton Pass, but for example with Bitwarden the flow works as follows:
  1. Follow your steps
  2. When the passkey window from Bitwarden appears, no passkey is offered. Close this window.
  3. Fluxer begins a passkey migration process automatically.
That step 2 is not at all intuitive and that feedback has been given to Hampus so he'll probably make this a bit more obvious for users very soon.
Permalink
Comment by ⦓⡷⠂NEONSY⠐⢾⦔
⦓⡷⠂NEONSY⠐⢾⦔ 1 vote Merged from #4607 2 replies
I'm not quite sure what you mean, since "migration" usually means moving an old fluxer.app passkey to fluxer.com. If the flow does only that, it doesn't help, as my passkey is already on fluxer.com, so there's nothing to migrate The issue is that the feedback site's sign-in still runs on fluxer.app, so the browser never offers the fluxer.com passkey there I think there has been a misunderstanding
Permalink
Comment by sodiboo
sodiboo OP1 vote
in the video i recorded for this, i specifically made a point to show that i cancelled the prompt (and commented that i could log in otherwise) because Yes it is very unintuitive that the normal pre-passkey-migration flow requires cancelling once! i hope that can be improved indeed! (NEONSY mentioned "WebAuthn Related Origins", which perhaps sounds less hacky than the current passkey bridge? and could work in both directions(?) (or always log in on fluxer.com, even for OAuth)) (note that i realize the comment i'm currently replying to didn't have that context because the issues were merged)
Permalink
Comment by sodiboo
sodiboo OP1 vote
also note that logging in normally does work. my passkey did migrate successfully, it does work when i try to log into the web app directly, without initiating the login from the feedback site. (i had tested this by logging out and back in, which i did successfully on fluxer.com, and perhaps that's why my feedback site session was invalidated, leading me to discover this)
Permalink