bitwarden / bitwarden/clients

Master password re-prompt not appearing when using "Log in with device"

Open
#7,746 10 comments 2 reactions 0 assignees View on GitHub
browser bug
Dominant language
TypeScript
Stars
13.8k
Forks
2k
Avg merge
3d 9h
Merged PRs (30d)
397

Description

### Steps To Reproduce

1. Open https://vault.bitwarden.com/ or the browser extension (other clients might be affected too)
2. Enter email address
3. Click *Continue*
4. Click *Log in with device*
5. Use your device to accept the log in request
6. Browse to a vault entry for which you know you enabled "Master password re-prompt"
7. View or edit this entry
8. Master password re-prompt does not appear

### Expected Result

I expected that regardless of which method I use to log in, the master password re-prompt will always appear.

### Actual Result

I can view master password protected vault entries without entering my master password.

### Screenshots or Videos

_No response_

### Additional Context

If this behavior is desired, this is not a bug, but I am pretty sure that most people do expect the master password re-prompt to appear regardless of the login method used.

### Operating System

Windows

### Operating System Version

11

### Web Browser

Chrome

### Browser Version

121.0.6167.86

### Build Version

2024.1.1

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Reproduce the flow in the web vault or browser extension using the listed steps, then inspect the login-with-device flow and the vault-entry master password re-prompt behavior. Done means entries protected by master password re-prompt require that password after device-based login, with the expected behavior verified in the affected client(s).

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.