Can't add a Passkey on facebook

[yashikada]

Have you searched for an existing issue?

• Yes, I tried searching and reviewed the pinned issues

Brief Summary

I can't add a passkey to facebook account.

Expected Versus Actual Behavior

The actual behavior is this:
I tried on Firefox Linux/Windows the latest version and the button "Create Passkey" is disabled.
I tried on Brave Linux/Windows the latest version and I got this error: Error!Origin and RP ID do not match

The expected behavior: add passkey to facebook account.

Steps to Reproduce

1. Login facebook
2. Goto settings and searching password in search settings
3. Click Password and Security
4. Click Passkey and follow the procedure

KeePassXC-Browser Debug Information

I tested on 4 browser these are the informations:

Brave:

KeePassXC - 2.7.10
KeePassXC-Browser - 1.9.11
Operating system: Linux x86_64
Browser: Chrome/Chromium 143.0.0.0

KeePassXC - 2.7.11
KeePassXC-Browser - 1.9.11
Operating system: Win64
Browser: Chrome/Chromium 143.0.0.0

Firefox:
KeePassXC - 2.7.10
KeePassXC-Browser - 1.9.11
Operating system: Linux x86_64
Browser: Mozilla Firefox 146.0

KeePassXC - 2.7.11
KeePassXC-Browser - 1.9.11
Operating system: Win64
Browser: Mozilla Firefox 146.0

[varjolintu]

It's a known issue. For me Facebook still restricts passkeys to mobile only, so I cannot even test this. The reports I've seen before indicates that Facebook is making passkey stuff from inside an iframe where the URL origin differs from the RP ID. This is Facebook doing non-standard things.

[varjolintu]

Checked again, and the feature is now enabled for me. The creation fails because no cross-origin registration is allowed. I couldn't inspect the actual request, but it's only logical that the probably use facebook.com as the RP ID but the passkey creation page is under https://accountscenter.facebook.com.

I tried this with Firefox and the Create button was enabled for me for a couple of tries, but after that it remained in disabled state.

[yashikada]

I tried this with Firefox and the Create button was enabled for me for a couple of tries, but after that it remained in disabled state.

This happened to me on Windows too, but on Linux it remains disabled. I think it's because Windows Security tries to create the passkey as a failback.

It's a known issue.

I couldn't find anything by searching, I tried now too but nothing, is it known but hasn't been opened as an issue?

[varjolintu]

This happened to me on Windows too, but on Linux it remains disabled. I think it's because Windows Security tries to create the passkey as a failback.

I tested this with macOS so it's Facebook doing Facebook things again.

I couldn't find anything by searching, I tried now too but nothing, is it known but hasn't been opened as an issue?

It was discussed in our Matrix channel, but yes, no issue was created because it seems like a Facebook issue after all.

[lact500]

Tried Facebook's passkey feature for the first time and couldn't make it work either. Curiously though, Facebook's passkey creation seems to be fairly buggy. I'm guessing because they don't use a common approach. A similar issue was reported on bitwarden recently (bitwarden/clients#17955) and it's yet to be seen if the proposed fix will solve this issue for Facebook (and/or any other sites that rely on Related Origin Requests for passkey creation).

[danrossi]

I just tried to setup my Yubikey as a Passkey in Brave. It let me setup the Passkey. but I see no option to "login with passkey" and I never get prompted for the Yubikey. I should be able to disable the password as I have done with Google. 2FA Yubikey won't let me register the device. My old account had Yubikey 2FA working since 2018.

[a2kolbasov]

The behavior on https://accountscenter.facebook.com/passkey/management varies across browsers. If the user has Chrome, then Related Origins is used. If Firefox, then Permissions Policy (creates <iframe allow="publickey-credentials-create *;" id="meta-passkey-create-iframe" src="https://accounts.meta.com/passkey/iframe/register/?…">). However, replacing window.PublicKeyCredential.getClientCapabilities() does not change the behavior. So I don't know how the cross-origin request mode is chosen.

[varjolintu]

@a2kolbasov I tested Facebook passkey creation and authentication with Firefox, and it worked just fine with Related Origins implementation.

[yashikada]

I tested, on linux firefox, the PR on the latest develop commit, loaded as temporary extension and set true dom.security.featurePolicy.webidl.enabled, the behavior is the same, button create passkey disabled.
What did I do wrong?
Should this work on chrome?

[a2kolbasov]

@a2kolbasov I tested Facebook passkey creation and authentication with Firefox, and it worked just fine with Related Origins implementation.

Does Facebook create such iframe in your Firefox?

fb-iframe.webm