Autofill consistently causes authentication to fail at specific URIs, where clipboard duplication does not.
- Dominant language
- TypeScript
- Stars
- 13.8k
- Forks
- 2k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 393
Description
### Steps To Reproduce
As [`community.bitwarden.com/t/57201`][3] explains:
[3]: https://community.bitwarden.com/t/how-to-get-list-of-every-vault-entry-with-disabled-autofill/57201?u=rokejulianlockhart
1. Visit any of the undermentioned URIs:
* [`theyworkforyou.com/user/login`](https://www.theyworkforyou.com/user/login/),
* [`ips-docs.com`](https://www.ips-docs.com/),
* [`artstation.com/users/sign_in`][4],
[4]: https://www.artstation.com/users/sign_in
* [`npmjs.com/login`][5],
[5]: https://www.npmjs.com/login
* [`theyworkforyou.com/user/login`][8],
[8]: https://www.theyworkforyou.com/user/login/?ret=%2Fsearch%2F%3Fq%3Dopen-source%2Bsoftware
* [`tunemymusic.com`][9],
[9]: https://www.tunemymusic.com/
* [`theadulthub.com/login.aspx`][6], or
[6]: https://theadulthub.com/login.aspx
* [`lemmy.world/login`][7].
[7]: https://lemmy.world/login
If [`gitlab.com/gitlab-com/www-gitlab-com/-/issues/13927#note_1429652006`](https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/13927#note_1429652006) is to be believed, even `GitLab.com` *may* be affected. However, I don't yet know whether the user utilises Bitwarden.
1. *Autofill* credentials with Bitwarden.
1. To demonstrate that autofill is the cause, replace those credentials with credentials manually duplicated to and from the clipboard (from Bitwarden if desired).
### Expected Result
Autofilling credentials should not prevent authentication if the credentials are correct.
### Actual Result
Autofilling the credentials causes authentication to fail, whereas manual provision of identical credentials allows authentication to succeed.
### Screenshots or Videos
1. > Edit by @djsmith85: Removed the video and attached it to an internal ticket.
1. https://github.com/user-attachments/assets/c06e5e4d-819f-48f0-ab3b-a981f45eef0a
### Additional Context
Do not merge this with [`clients/issues/1621`][2].
[2]: https://github.com/bitwarden/clients/issues/1621#issue-811491652
### Operating System Version
1.
~~~sh
#!/usr/bin/env pwsh
$OSRelease = [Ordered]@{}
Get-Content /etc/os-release | ForEach-Object {
If ($_ -Match '^\s*([^=]+)=(.*)$') {
$Name = $Matches[1]
$Value = $Matches[2]
If ($Value -Match '^"(.*)"$') {
$Value = $Matches[1]
}
If ($Value -Match '^[0-9]+$') {
$Value = [Int64]$Value
}
$OSRelease[$Name] = $Value
}
}
[PSCustomObject]$OSRelease |
Select-Object NAME, VARIANT, VERSION_ID |
Format-List |
yq -P
~~~
1.
~~~YAML
NAME: Fedora Linux
VARIANT: KDE Plasma Desktop Edition
VERSION_ID: 44
~~~
### Browser Version
1.
~~~sh
#!/usr/bin/env pwsh
rpm -qf (Get-Command firefox-nightly).Source --queryformat @'
Name: %{NAME}
Version: %{VERSION}
Release: %{RELEASE}
Architecture: %{ARCH}
Install Date: %{INSTALLTIME:date}
Size: %{SIZE}
Signature: %{SIGPGP:pgpsig}
Source RPM: %{SOURCERPM}
Build Date: %{BUILDTIME:date}
Build Host: %{BUILDHOST}
Packager: %{PACKAGER}
Vendor: %{VENDOR}
'@ | yq -P
~~~
1.
~~~YAML
Name: firefox-nightly
Version: 153.0a1
Release: 20260608093228
Architecture: x86_64
Install Date: Tue 09 Jun 2026 17:33:29 BST
Size: 389659876
Signature: (none)
Source RPM: firefox-nightly-153.0a1-20260608093228.src.rpm
Build Date: Mon 08 Jun 2026 12:38:04 BST
Build Host: 04134c35fa9e
Packager: (none)
Vendor: Mozilla
~~~
### Environment Versions
~~~YAML
Version: 2026.5.0
SDK: 'main (e13c4fc)'
Server version: 2026.6.0
~~~
### Issue Tracking Info
- [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Contributor guide
Research direction
No source file, test, or entry point is identified. Start by reproducing the failure in Firefox Nightly on the listed URIs, comparing Bitwarden autofill with manually copied credentials. Done means identifying the client-side cause and confirming that autofilled credentials authenticate successfully without regressing the clipboard comparison.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100