bitwarden / bitwarden/ios

Autofill always asks for master password, unless "session timeout" is set to "never", when biometric and PIN unlock both disabled

Open
#1,167 68 comments 32 reactions 0 assignees View on GitHub
app:password-manager bug
Dominant language
Swift
Stars
684
Forks
154
Avg merge
7d 2h
Merged PRs (30d)
32

Description

### Steps To Reproduce

1. Set up autofill as requested in the bitwarden app
2. Set the "Session timeout" to 15 minutes
3. Make sure "Unlock with Face ID" and "Unlock with PIN code" are deactivated
4. Go to a website with a login
5. Try to autofill (tapping e.g. the "Passwords" button on the onscreen keyboard): the Bitwarden autofill window opens.
6. Enter the master password
7. Go to another website login
8. Tap on 'Passwords' before the 15 minutes have passed
9. Bitwarden autofill window opens again, asking again for the master password

### Expected Result

Bitwarden should not ask for the master password again, if the second time it is opened falls into the window set by "Session timeout".

### Actual Result

Bitwarden always asks for the master password.

The only way I could avoid this is by setting in step 2 "Session timeout" to "never". Then autofill never asks for the master password.

However, this is obviously not an ideal setting.

### Screenshots or Videos

_No response_

### Additional Context

This behavior of the bitwarden autofill is especially annoying for logins that span two pages, such as gmail. Then you have to enter the master password twice for one login.

One can find similar reports e.g. on reddit (see below) since quite a while. Typically, the advice is to use biometrics. Indeed, if I enable biometrics, bitwarden will scan my face every time in autofill. However, I would prefer to avoid using Face-ID for various reasons. Also, given that "never" actually works as expected, any other session timeout should work, too.

Examples of similar issues reported online:
- https://www.reddit.com/r/Bitwarden/comments/zlp9an/constantly_having_to_reenter_master_password_ios/
- https://www.reddit.com/r/Bitwarden/comments/10g0m8k/ios_app_bitwarden_prompts_for_master_password/

### Build Version

Version 2024.11.0 (1680)

### What server are you connecting to?

EU

### Self-host Server Version

_No response_

### Environment Details

- Device: IPad Pro (11-inch, second generation)
- IPadOS Version: 18.1
-

### Issue Tracking Info

- [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue through the iPadOS autofill window with a 15-minute session timeout and both biometric and PIN unlock disabled. Trace the autofill unlock flow and session-timeout handling; done means a second autofill within the configured window does not request the master password, while the existing behavior for "never" remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, swift
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.