- Affected version
- 2.3.7
When logging in with a Passkey, XenForo automatically sets cookie
IMHO this doesn't make much sense and probably annoys & confuses users.
XenForo should either
_user so th user stays "logged in" but it does not set cookie tfa_trust so for the next session a TFA verification is required - which can be performed with the same Passkey that was used to initially log in.IMHO this doesn't make much sense and probably annoys & confuses users.
XenForo should either
- Always set
userandtfa_trustcookies when logging in via Passkey
Preferred - Never set remember cookie when logging in via Passkey
- Only set remember cookie when logging in via Passkey if the checkbox is ticked and also set
tfa_trustin this is the case - Ask the user wether they want to trust the device when logging in via Passkey just like it would be done if login was performed via password