nextcloud / passman-webextension

Webextension for the Passman Nextcloud app. Also offers browser extension & Android app.
https://passman.cc
GNU Affero General Public License v3.0
113 stars 43 forks source link

Server credentials ignored for Nextcloud instances with active login sessions #344

Open brainchild0 opened 10 months ago

brainchild0 commented 10 months ago

The mechanism for connecting to a Nextcloud instance and account is rather clumsy.

The extension collects login information, including the passowrd, but only needs them if the user has no login session for the Nextcloud instance in the browser. If a session exists, the the extension ignores the credentials. Presumably, a failure may occur later if the credentials are invalid, since they were never verified against the user account of the server.

Even though the function of the extension is storing passwords, ideally the extension would never directly collect the password for a Nextcloud user account, instead using an existing session from the browser.