@Reedy mentioned that we should consider the issues flagged up in T248339 when we work on this in future.

Bumping this ticket that was discovered in iOS grooming. Judging by our closed spike, we needed to make the login form more dynamic to respond to the values returned in the "fields" key from the login call:

Call:
POST https://en.wikipedia.org/w/api.php (action=query&amirequestsfor=login&format=json&meta=authmanagerinfo)

Response

{
  "batchcomplete": "",
  "query": {
    "authmanagerinfo": {
      "canauthenticatenow": "",
      "cancreateaccounts": "",
      "preservedusername": "",
      "requests": [
        {
          "id": "MediaWiki\\Auth\\PasswordAuthenticationRequest",
          "metadata": {},
          "required": "primary-required",
          "provider": "Password-based authentication",
          "account": "",
          "fields": {
            "username": {
              "type": "string",
              "label": "Username",
              "help": "Username for authentication."
            },
            "password": {
              "type": "password",
              "label": "Password",
              "help": "Password for authentication.",
              "sensitive": ""
            }
          }
        },
        {
          "id": "MediaWiki\\Auth\\RememberMeAuthenticationRequest",
          "metadata": {},
          "required": "optional",
          "provider": "MediaWiki\\Auth\\RememberMeAuthenticationRequest",
          "account": "MediaWiki\\Auth\\RememberMeAuthenticationRequest",
          "fields": {
            "rememberMe": {
              "type": "checkbox",
              "label": "Keep me logged in (for up to 365 days)",
              "help": "Whether the password should be remembered for longer than the length of the session.",
              "optional": ""
            }
          }
        }
      ]
    }
  }
}

We would like to implement oAuth in the near future (here's the associated spike) - given that and the low priority on this one, is task still worth doing? Does it only involve making those fields dynamic or am I missing something else?

With the more widespread adoption of FIDO2 passwordless authentication (aka passkeys) across the web, especially on Android and iOS, shouldn't there be a renewed impetus to implement this now? I was quite taken aback that I was locked out of my account on the iOS app after turning on WebAuth via Wikipedia on my desktop browser. There was no warning on the website that the Mobile Apps don't support this 2FA method yet.

Sorry about the surprise @Netsnipe. I have added a mention of this missing support in https://en.wikipedia.org/wiki/Help:Two-factor_authentication#WebAuthn.

@Netsnipe There have been blockers in the past on this (T248339, T354701, T348388), so we have not considered this up to this point. We need to do a fresh investigation on what this change would take for the apps team. We have reopened our original investigation spike task (T231242), but note that this support is not on our roadmap. Thank you for flagging and bringing this to our attention.