Skip to content
This repository was archived by the owner on Dec 14, 2021. It is now read-only.
This repository was archived by the owner on Dec 14, 2021. It is now read-only.

Lockwise does not utilize the full Website Address that is input and instead truncates to just the Domain Name #147

@dewrox

Description

@dewrox

Reproduction Steps:

  1. Create new Credential with website address of:
    https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_HOMEDEPOT&langId=en_US#signon
    Username:
    TestAccount
    Step 1 - Create first Credential
  2. Save new Credential
  3. View Credential from step 2 and notice that for Website Address it only saved:
    https://citiretailservices.citibankonline.com
    Step 3 - View first Credential
  4. Create new Credential with website address of:
    https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_COSTCO&langId=en_US#signon
    Username:
    TestAccount
    Step 4 - Create Second Credential
  5. Save new Credential and Receive Error
    Step 5 - Recieve Error

Conclusion:

If you have a Citibank CC entry stored for Home Depot
https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_HOMEDEPOT&langId=en_US#signon

but you also have a Costco CC
https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_COSTCO#signon

Since Lockwise truncates the Website Address down to the Domain Name (with subdomain) then it doesn't see the two as unique entries since the Username for both is the same and we all know people can use the same username.

You should be able to save both logins separately as you really should not use the same password for both, the user can not be forced to change their username.
By saving the entire address so that the Website Address remains unique you handle the potential problem of the users username is not always going to be unique.

This will obviously bring up the question of "Ok, but what are we supposed to do if the website owner makes a change and that URL is no longer legitimate?" and the answer is that if the user ends up on the domain of citiretailservices.citibankonline.com and a username and password box is on the page and that page does not match one of the two that you have saved above... give the user the option to use either of them.

And BOOM... Issue solved.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions