Refreshing browser on webvault locks vault #738

New Issue

OVERLORD · 2026-02-04T22:23:29+03:00

OVERLORD commented

2026-02-04 22:23:29 +03:00

Originally created by @renannprado on GitHub (Jul 4, 2020).

Subject of the issue

bitwarden_rs is requesting for the vault to be unlocked after refresh even though it's set to lock after 15min.

Your environment

Bitwarden_rs version: 1.15.1
Install method: Deployed to Kubernetes
Clients used: Firefox
Reverse proxy and version: Kubernetes Nginx Ingress
Version of mysql/postgresql: N/A

Steps to reproduce

Login into the web vault, check that your Vault Timeout is set to 15min, then refresh the browser. After the refresh, you'll be asked for the vault to be unlocked again even though 15min hasn't passed.

Expected behaviour

As long as the Vault Timeout hasn't been reached, the web vault should be kept unlocked, regardless of page refresh.

Actual behaviour

After refreshing the browser, the webvault locks, ignoring the Vault Timeout you have set.

Relevant logs

N/A

Originally created by @renannprado on GitHub (Jul 4, 2020). ### Subject of the issue bitwarden_rs is requesting for the vault to be unlocked after refresh even though it's set to lock after 15min. ### Your environment * Bitwarden_rs version: 1.15.1 * Install method: Deployed to Kubernetes * Clients used: Firefox * Reverse proxy and version: Kubernetes Nginx Ingress * Version of mysql/postgresql: N/A ### Steps to reproduce Login into the web vault, check that your Vault Timeout is set to 15min, then refresh the browser. After the refresh, you'll be asked for the vault to be unlocked again even though 15min hasn't passed. ### Expected behaviour As long as the Vault Timeout hasn't been reached, the web vault should be kept unlocked, regardless of page refresh. ### Actual behaviour After refreshing the browser, the webvault locks, ignoring the `Vault Timeout` you have set. ### Relevant logs N/A

OVERLORD closed this issue

2026-02-04 22:23:34 +03:00

OVERLORD commented

2026-02-04 22:23:36 +03:00

@dani-garcia commented on GitHub (Jul 5, 2020):

This is how it works in the official vault, I assume to avoid having to store the master password as cookies or in the browsers local storage. We try to keep the web vault's code as close as possible to the upstream version, with only minimal patches, so if you want this feature to be different, you might try checking the official comunity for an open thread or you can create one yourself: https://community.bitwarden.com/.

That said, checking at the available options which are something like:

1 minute
2 minutes
...
When refreshing the page

It does seem to imply that all but the last option only lock when the time limit is reached, i guess the last option should probably be named "Only when refreshing the page" instead.

@dani-garcia commented on GitHub (Jul 5, 2020): This is how it works in the official vault, I assume to avoid having to store the master password as cookies or in the browsers local storage. We try to keep the web vault's code as close as possible to the upstream version, with only minimal patches, so if you want this feature to be different, you might try checking the official comunity for an open thread or you can create one yourself: https://community.bitwarden.com/. That said, checking at the available options which are something like: - 1 minute - 2 minutes - ... - When refreshing the page It does seem to imply that all but the last option only lock when the time limit is reached, i guess the last option should probably be named "Only when refreshing the page" instead.

OVERLORD commented

2026-02-04 22:23:41 +03:00

@wirwolf commented on GitHub (Dec 13, 2023):

@dani-garcia you can store the access token with the refresh token and expired time. And when the user refresh the page frontend request to the server and validate session(IP, user agent, fingerprint,other params).

You can also add an option in the user profile for not saving token locally.

This case is very decreasing usability.

@wirwolf commented on GitHub (Dec 13, 2023): @dani-garcia you can store the access token with the refresh token and expired time. And when the user refresh the page frontend request to the server and validate session(IP, user agent, fingerprint,other params). You can also add an option in the user profile for not saving token locally. This case is very decreasing usability.

OVERLORD referenced this issue

2026-02-05 04:56:01 +03:00

[PR #738] [MERGED] Added netcup domains to global domains #2764

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#738