bitwarden / bitwarden/android

[BWA-182] MTLS not used in icon retrieval logic.

Open
#5,675 9 comments 1 reaction 0 assignees View on GitHub
app:authenticator bug
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Steps To Reproduce

First of all using MTLS with cloudflare tunnel. I can create and delete items just fine.
This generated no log rules as they pass successfully.

However in my cloudflare logs I see a block on rule being activated on: (Method GET)
/icons/ < ip of local pihole > /icon.png
and /icons/ < ip of selfhosted instance > /icon.png
As both do this on my DNS record and I see source IP to be sure it's my attempts I wonder if this is a app bug or not.
As user agent the following is mentioned
Dalvik/2.1.0 (Linux; U; Android 15; CPH2581 Build/AP3A.240617.008)

I think somewhere something in the code is skipping the MTLS check.
The app it self doesn't show any error. I only see this in the logs.

### Expected Result

no security error logs

### Actual Result

Security errors that no MTLS is used.

### Screenshots or Videos

_No response_

### Additional Context

_No response_

### Build Version

2025.6.1 (20398)

### What server are you connecting to?

Self-host

### Self-host Server Version

2025.5.0

### Environment Details

- OnePlus 12 (Oxygen OS 15.0), Android 15 with july 2025 security update

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.