Fixed Login via Passkey sets remember but not tfa_trust cookie

[Kirby]

Affected version

2.3.7

When logging in with a Passkey, XenForo automatically sets cookie _user so th user stays "logged in" but it does not set cookie tfa_trust so for the next session a TFA verification is required - which can be performed with the same Passkey that was used to initially log in.

IMHO this doesn't make much sense and probably annoys & confuses users.

XenForo should either

1. Always set user and tfa_trust cookies when logging in via Passkey
   Preferred
2. Never set remember cookie when logging in via Passkey
3. Only set remember cookie when logging in via Passkey if the checkbox is ticked and also set tfa_trust in this is the case
4. Ask the user wether they want to trust the device when logging in via Passkey just like it would be done if login was performed via password

 

[XF Bug Bot]

Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.3.8).

Change log:

Set tfa_trust cookie when logging in with a passkey (#1210)

There may be a delay before changes are rolled out to the XenForo Community.