bitwarden / bitwarden/clients

Autofill consistently causes authentication to fail at specific URIs, where clipboard duplication does not.

Open
#4,697 9 comments 0 reactions 0 assignees View on GitHub
browser bug
Dominant language
TypeScript
Stars
13.8k
Forks
2k
Avg merge
3d 9h
Merged PRs (30d)
393

Description

### Steps To Reproduce

As [`community.bitwarden.com/t/57201`][3] explains:

[3]: https://community.bitwarden.com/t/how-to-get-list-of-every-vault-entry-with-disabled-autofill/57201?u=rokejulianlockhart

1. Visit any of the undermentioned URIs:

* [`theyworkforyou.com/user/login`](https://www.theyworkforyou.com/user/login/),

* [`ips-docs.com`](https://www.ips-docs.com/),

* [`artstation.com/users/sign_in`][4],

[4]: https://www.artstation.com/users/sign_in

* [`npmjs.com/login`][5],

[5]: https://www.npmjs.com/login

* [`theyworkforyou.com/user/login`][8],

[8]: https://www.theyworkforyou.com/user/login/?ret=%2Fsearch%2F%3Fq%3Dopen-source%2Bsoftware

* [`tunemymusic.com`][9],

[9]: https://www.tunemymusic.com/

* [`theadulthub.com/login.aspx`][6], or

[6]: https://theadulthub.com/login.aspx

* [`lemmy.world/login`][7].

[7]: https://lemmy.world/login

If [`gitlab.com/gitlab-com/www-gitlab-com/-/issues/13927#note_1429652006`](https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/13927#note_1429652006) is to be believed, even `GitLab.com` *may* be affected. However, I don't yet know whether the user utilises Bitwarden.

1. *Autofill* credentials with Bitwarden.

1. To demonstrate that autofill is the cause, replace those credentials with credentials manually duplicated to and from the clipboard (from Bitwarden if desired).

### Expected Result

Autofilling credentials should not prevent authentication if the credentials are correct.

### Actual Result

Autofilling the credentials causes authentication to fail, whereas manual provision of identical credentials allows authentication to succeed.

### Screenshots or Videos

1. > Edit by @djsmith85: Removed the video and attached it to an internal ticket.

1. https://github.com/user-attachments/assets/c06e5e4d-819f-48f0-ab3b-a981f45eef0a

### Additional Context

Do not merge this with [`clients/issues/1621`][2].

[2]: https://github.com/bitwarden/clients/issues/1621#issue-811491652

### Operating System Version

1.

~~~sh
#!/usr/bin/env pwsh
$OSRelease = [Ordered]@{}
Get-Content /etc/os-release | ForEach-Object {
If ($_ -Match '^\s*([^=]+)=(.*)$') {
$Name = $Matches[1]
$Value = $Matches[2]
If ($Value -Match '^"(.*)"$') {
$Value = $Matches[1]
}
If ($Value -Match '^[0-9]+$') {
$Value = [Int64]$Value
}
$OSRelease[$Name] = $Value
}
}
[PSCustomObject]$OSRelease |
Select-Object NAME, VARIANT, VERSION_ID |
Format-List |
yq -P
~~~

1.

~~~YAML
NAME: Fedora Linux
VARIANT: KDE Plasma Desktop Edition
VERSION_ID: 44
~~~

### Browser Version

1.

~~~sh
#!/usr/bin/env pwsh
rpm -qf (Get-Command firefox-nightly).Source --queryformat @'
Name: %{NAME}
Version: %{VERSION}
Release: %{RELEASE}
Architecture: %{ARCH}
Install Date: %{INSTALLTIME:date}
Size: %{SIZE}
Signature: %{SIGPGP:pgpsig}
Source RPM: %{SOURCERPM}
Build Date: %{BUILDTIME:date}
Build Host: %{BUILDHOST}
Packager: %{PACKAGER}
Vendor: %{VENDOR}
'@ | yq -P
~~~

1.

~~~YAML
Name: firefox-nightly
Version: 153.0a1
Release: 20260608093228
Architecture: x86_64
Install Date: Tue 09 Jun 2026 17:33:29 BST
Size: 389659876
Signature: (none)
Source RPM: firefox-nightly-153.0a1-20260608093228.src.rpm
Build Date: Mon 08 Jun 2026 12:38:04 BST
Build Host: 04134c35fa9e
Packager: (none)
Vendor: Mozilla
~~~

### Environment Versions

~~~YAML
Version: 2026.5.0
SDK: 'main (e13c4fc)'
Server version: 2026.6.0
~~~

### Issue Tracking Info

- [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

No source file, test, or entry point is identified. Start by reproducing the failure in Firefox Nightly on the listed URIs, comparing Bitwarden autofill with manually copied credentials. Done means identifying the client-side cause and confirming that autofilled credentials authenticate successfully without regressing the clipboard comparison.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.