Grabbing wrong favicon #1831

New Issue

OVERLORD · 2025-10-09T17:32:05+03:00

OVERLORD commented

2025-10-09 17:32:05 +03:00

Originally created by @PrivatePuffin on GitHub.

Subject of the issue

It seems Bitwarden_rs always tries to download favicons from domain-root and ignores actual favicon settings on the login page. this leads to an abundance of errors/warnings and timeouts.

Your environment

Bitwarden_rs version:

Install method:
Clients used:
Reverse proxy and version:
Version of mysql/postgresql:
Other relevant information:

Steps to reproduce

Add a login for this site:
https://signin.netapp.com/oamext/login.html

Look at the logs, notice it tries to download the favicon from:
http://signin.netapp.com/favicon.ico
Notice how it fails to download the icon.

Now look at the page network tab, notice the actual URL for the favicon is:
https://signin.netapp.com/oamext/images/favicon.ico

Now look at the page source, notice that the favicon is described here:

 <link href="./images/favicon.ico" rel="icon" type="image/x-icon">
      <link href="./images/favicon.ico" rel="shortcut icon" type="image/x-icon">

Expected behaviour

It should respect the favicon setting of the login pages.

Actual behaviour

It always tries to grab domain-root favicons and totally ignores actual favicon settings.

Relevant logs

[2020-01-30 18:16:55][bitwarden_rs::api::icons][INFO] Icon save error: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }
[2020-01-30 18:16:55][response][INFO] GET /icons/<domain>/icon.png (icon) => 200 OK
[2020-01-30 18:16:55][bitwarden_rs::api::icons][INFO] Download failed for http://signin.netapp.com/favicon.ico
[2020-01-30 18:16:55][bitwarden_rs::api::icons][ERROR] Error downloading icon: Empty response
[2020-01-30 18:16:55][bitwarden_rs::api::icons][INFO] Icon save error: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }

Originally created by @PrivatePuffin on GitHub. ### Subject of the issue It seems Bitwarden_rs always tries to download favicons from domain-root and ignores actual favicon settings on the login page. this leads to an abundance of errors/warnings and timeouts. ### Your environment  * Bitwarden_rs version:  * Install method: * Clients used:  * Reverse proxy and version:  * Version of mysql/postgresql:  * Other relevant information: ### Steps to reproduce Add a login for this site: https://signin.netapp.com/oamext/login.html Look at the logs, notice it tries to download the favicon from: `http://signin.netapp.com/favicon.ico` Notice how it fails to download the icon. Now look at the page network tab, notice the actual URL for the favicon is: `https://signin.netapp.com/oamext/images/favicon.ico` Now look at the page source, notice that the favicon is described here: ``` <link href="./images/favicon.ico" rel="icon" type="image/x-icon"> <link href="./images/favicon.ico" rel="shortcut icon" type="image/x-icon"> ``` ### Expected behaviour It should respect the favicon setting of the login pages. ### Actual behaviour It always tries to grab domain-root favicons and totally ignores actual favicon settings. ### Relevant logs ``` [2020-01-30 18:16:55][bitwarden_rs::api::icons][INFO] Icon save error: Os { code: 13, kind: PermissionDenied, message: "Permission denied" } [2020-01-30 18:16:55][response][INFO] GET /icons/<domain>/icon.png (icon) => 200 OK [2020-01-30 18:16:55][bitwarden_rs::api::icons][INFO] Download failed for http://signin.netapp.com/favicon.ico [2020-01-30 18:16:55][bitwarden_rs::api::icons][ERROR] Error downloading icon: Empty response [2020-01-30 18:16:55][bitwarden_rs::api::icons][INFO] Icon save error: Os { code: 13, kind: PermissionDenied, message: "Permission denied" } ```

OVERLORD closed this issue

2025-10-09 17:32:06 +03:00

OVERLORD commented

2025-10-09 17:32:08 +03:00

@dani-garcia commented on GitHub:

Well the clients only send the subdomain and domain, in this case the server gets https://signin.netapp.com, so if the image can't be obtained from there then there isn't much we can do other than hardcode the value.

@dani-garcia commented on GitHub: Well the clients only send the subdomain and domain, in this case the server gets `https://signin.netapp.com`, so if the image can't be obtained from there then there isn't much we can do other than hardcode the value.

OVERLORD commented

2025-10-09 17:32:08 +03:00

@PrivatePuffin commented on GitHub:

This problem mostly shows with websites that host a login page on a sub page, but don't host anything on the login subdomain itself.

Another example:
https://signin.ea.com/ doesn't host anything (and errors out on the favicon too)
Because this is the real login page:
https://signin.ea.com/p/web2/login*LOGIN DATA STRING*

@PrivatePuffin commented on GitHub: This problem mostly shows with websites that host a login page on a sub page, but don't host anything on the login subdomain itself. Another example: `https://signin.ea.com/ ` doesn't host anything (and errors out on the favicon too) Because this is the real login page: `https://signin.ea.com/p/web2/login*LOGIN DATA STRING*`

OVERLORD commented

2025-10-09 17:32:09 +03:00

@PrivatePuffin commented on GitHub:

@dani-garcia Thats quite a major design oversight by upstream. As favicon locations are not actually standardised at all. But indeed, not yours to fix, you can't magically summon what you don't have.

Thanks for the reply :)

@PrivatePuffin commented on GitHub: @dani-garcia Thats quite a major design oversight by upstream. As favicon locations are not actually standardised at all. But indeed, not yours to fix, you can't magically summon what you don't have. Thanks for the reply :)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#1831