Autofill always asks for master password, unless "session timeout" is set to "never", when biometric and PIN unlock both disabled
- Dominant language
- Swift
- Stars
- 684
- Forks
- 154
- Avg merge
- 7d 2h
- Merged PRs (30d)
- 32
Description
### Steps To Reproduce
1. Set up autofill as requested in the bitwarden app
2. Set the "Session timeout" to 15 minutes
3. Make sure "Unlock with Face ID" and "Unlock with PIN code" are deactivated
4. Go to a website with a login
5. Try to autofill (tapping e.g. the "Passwords" button on the onscreen keyboard): the Bitwarden autofill window opens.
6. Enter the master password
7. Go to another website login
8. Tap on 'Passwords' before the 15 minutes have passed
9. Bitwarden autofill window opens again, asking again for the master password
### Expected Result
Bitwarden should not ask for the master password again, if the second time it is opened falls into the window set by "Session timeout".
### Actual Result
Bitwarden always asks for the master password.
The only way I could avoid this is by setting in step 2 "Session timeout" to "never". Then autofill never asks for the master password.
However, this is obviously not an ideal setting.
### Screenshots or Videos
_No response_
### Additional Context
This behavior of the bitwarden autofill is especially annoying for logins that span two pages, such as gmail. Then you have to enter the master password twice for one login.
One can find similar reports e.g. on reddit (see below) since quite a while. Typically, the advice is to use biometrics. Indeed, if I enable biometrics, bitwarden will scan my face every time in autofill. However, I would prefer to avoid using Face-ID for various reasons. Also, given that "never" actually works as expected, any other session timeout should work, too.
Examples of similar issues reported online:
- https://www.reddit.com/r/Bitwarden/comments/zlp9an/constantly_having_to_reenter_master_password_ios/
- https://www.reddit.com/r/Bitwarden/comments/10g0m8k/ios_app_bitwarden_prompts_for_master_password/
### Build Version
Version 2024.11.0 (1680)
### What server are you connecting to?
EU
### Self-host Server Version
_No response_
### Environment Details
- Device: IPad Pro (11-inch, second generation)
- IPadOS Version: 18.1
-
### Issue Tracking Info
- [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Contributor guide
Research direction
Start by reproducing the issue through the iPadOS autofill window with a 15-minute session timeout and both biometric and PIN unlock disabled. Trace the autofill unlock flow and session-timeout handling; done means a second autofill within the configured window does not request the master password, while the existing behavior for "never" remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios, swift
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100