mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-02-05 00:29:40 +03:00
Login session expired with account switching #1214
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cksapp on GitHub (Feb 11, 2022).
Low priority issue, noticed a slight issue with the newest release of the Bitwarden Desktop app 1.31.0
When trying to use the new Account Switching feature, you are able to login to one account with Vaultwarden as normal.
After login to another account with the same VW server, the first initial account logged in will time out.
Latest release of the desktop app reinstalled, and Vaultwarden server upgraded to latest 1.24.0
@BlackDex commented on GitHub (Feb 11, 2022):
Confirmed. It looks like it is trying to access the token,
[INFO] (login) POST /identity/connect/token, but not allowed.@cksapp commented on GitHub (Feb 11, 2022):
Thanks for the info, pretty interesting to know.
I will note it seems this is even less of a priority issue as upstream had several major issues with this release and have rolled back to 1.30 as latest. Who's to say what changes may be made, my guess not much would be changed but best not to even worry about it until this is fully patched and a new public release is available.
@BlackDex commented on GitHub (Feb 24, 2022):
I digged a little bit into this. And it looks like we currently only have a uniqueness on the device-id.
This in turn makes it that we overwrite this when a new user logs-in, which effectively deletes there refresh token.
To change this we need to change the whole code regarding the device table to match on both device-id and user-id on all fronts.
This will take some time and needs some good testing. But it is one the list now :).
Thanks for the report.
@BlackDex commented on GitHub (Mar 3, 2022):
Small update, i think i have a working patch. I just need some time to do some final checking :)