mirror of
https://github.com/bitwarden/android.git
synced 2026-03-12 05:04:17 -05:00
Android - Bitwarden does not lock after the Vault Timeout duration passes. #1164
Closed
opened 2025-11-26 22:40:49 -06:00 by GiteaMirror
·
47 comments
No Branch/Tag Specified
main
sdlc/sdk-update
fix/PM-33394-throwable-extensions
fix/PM-33394-sync-unlock-error
PM-24380/flight-recorder-redact-hostname
release/2026.3-rc48
claude/android-implementer-agent
PM-26577-app-links-support
PM-26896-autofill-fix
renovate/lock-file-maintenance
release/2026.2-rc47
PM-32714/fallback-to-web-vault-host
pr-6572
PM-28834/setting-app-layout-horizonos
vvolkgang/process-release-notes-v2
release/2026.2-rc46
release/2026.1-rc45
PM-30644/added-logs-for-debug
PM-30644/quicktile-nav-not-showing-migration
minor-gradle-updates
release/2026.1-rc42
release/2026.1-rc44
release/2026.1-rc43
PM-28834/set-landscape-on-horizonos-devices
context-rules
devclarity/update-code-review-command
PM-20026/force-ltr-passwords-and-codes
release/2025.12-rc41
cmcg/testCoverage
claude-skill/creating-feature-flags
PM-29014/talkback-support-for-passwords
release/2025.12-rc40
BRE-1305/publish_test
accept-user-certs
autofill-permissions
release/2025.11-rc39
PM-22479/check-all-certificates-validate-asset-links
release/2025.10-rc38
agalles/android-latest
optimize-test-workflows
tier2-test-sharding
retro-agent
PM-27001/skip-account-selection-only-one-exists-cxp
release/2025.10-rc37
agalles/test-1118
release/2025.10-rc36
PM-20593-token-refresh
QA-1126b/adding-native-sanity-test
release/2025.9-rc35
pm-25933/sdk-update-password
release/2025.9-rc34
release/2025.8-rc33
agalles/20250821-release
debug-release-issues
pm-24249-allow-automated-prs-for-sdk-updates
release/2025.8-rc32
release/WORKFLOW-TEST-2025.8-rc28
agalles/20250807release
release/2025.07-rc25
release/hotfix-v2025.7.0-bwa
pm-23311/export-vault-policy-bypass
release/2025.07-rc24
authenticator-pm-sync-flags-issue
ps/implement-sdk-repository-example
release/hotfix-v2025.6.0-bwpm
release/2025.06-rc21
agalles/automate-android-fastlane-patch
release/2025.05-rc20
release/2025.04-rc19
languages/basque
release/2025.03-rc19
update-readme
qrcode/feature
innovation/archive/pm-19153-archive-items
qrcode/2-ui-fields
qrcode/1-page
hold-on-biometric-prompt-alternative
release-notes-process
release/2025.02-rc16
bwa-monorepo
PM-8223/new-device-verification-ux-improvements
pm-18451/exempt-from-policies
test-bwa
cs-workaround-linked-0-copy
release/2025.01-rc15
release/2025.01-rc14
release/2024.12-rc13
pm-16670/sync-leave-notice
821
PM-16695/backport-lean-more-new-device-verification
km/15084-testing
release/hotfix-v2024.11.7
release/2024.11-rc1
pm-11304/collection-add-item-button
PM-14241/disabling-logs-app-crash
poc/offline-editing
new-version-calc
pm-11649/expired-link-services
pm-6702/add-feature-flag
pm-6702/email-verification-feature
pm-9933/marketing-copy-update
pm-6702/registration-flows
update-templates
pm-6701/email-verification-selfhost-registration
v2026.2.1-bwpm
v2026.2.1-bwa
v2026.2.0-bwpm
v2026.2.0-bwa
v2026.1.1-bwa
v2026.1.1-bwpm
temp-test
v2026.1.0-bwpm
v2026.1.0-bwa
v2025.12.1-bwa
v2025.12.1-bwpm
v2025.12.0-bwa
v2025.12.0-bwpm
v2025.11.1-bwpm
v2025.11.1-bwa
v2025.11.0-bwpm
v2025.11.0-bwa
v2025.10.1-bwa
v2025.10.1-bwpm
v2025.10.0-bwa
v2025.10.0-bwpm
v2025.9.1-bwa
v2025.9.1-bwpm
v2025.9.0-bwa
v2025.9.0-bwpm
v2025.8.1-bwa
v2025.8.1-bwpm
v2025.8.0-bwa
v2025.8.0-bwpm
v2025.7.2-bwa
v2025.7.2-bwpm
v2025.7.1-bwa
v2025.7.1-bwpm
v2025.7.0-bwa
v2025.7.0-bwpm
v2025.6.1-bwpm
v2025.6.0-bwa
v2025.6.0-bwpm
v2025.1.0-bwa
v2025.5.0-bwa
v2025.5.0-bwpm
v2025.5.999
2025.4.0
v2025.4.0
untagged-4731eaadac73f3dfbbb8
v2025.3.0
v2025.2.0
untagged-815a165c5d70ffe75bc7
v2025.1.2
v2025.1.1
v2025.1.0
v2024.12.0
untagged-5a76b6392a4c8998c63a
v2024.11.7
v2024.11.6
v2024.11.5
v2024.11.4
v2024.11.3
v2024.11.2
v2024.11.1
v2024.11.0
v2024.10.2
v2024.10.1
v2024.10.0
v2024.9.0
v2024.8.1
v2024.8.0
v2024.7.3
v2024.7.2
v2024.7.1
v2024.7.0
v2024.6.1
v2024.6.0
v2024.5.1
v2024.4.1
v2024.4.2
v2024.4.0
v2024.3.3
v2024.3.1
v2024.3.0
v2024.2.1
v2024.2.0
v2024.1.1
v2024.1.0
v2023.12.0
v2023.10.0
v2023.9.2
maui-single-project-android
v2023.9.1
v2023.9.0
v2023.8.0
v2023.7.0
v2023.5.0
v2023.4.0
v2023.3.2
v2023.3.1
v2023.3.0
v2023.2.0
v2023.1.0
v2022.11.0
v2022.10.0
v2022.9.1
v2022.9.0
v2022.8.0
v2022.6.2
v2022.6.1
v2022.6.0
v2022.05.0
v2.18.0
v2.17.0
v2.16.4
v2.16.3
v2.16.2
v2.16.1
v2.15.0
v2.14.2
v2.14.1
v2.14.0
v2.13.0
v2.12.0
v2.11.3
v2.11.2
v2.11.1
v2.11.0
v2.10.0
v2.9.1
v2.9.0
v2.8.2
v2.8.1
v2.8.0
v2.7.2
v2.7.0
v2.6.1
v2.6.0
v2.5.6
v.2.5.5
v2.5.5
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5.0
v2.4.3
v2.4.2
v2.4.1
v2.4.0
v2.3.1
v2.3.0
v2.2.8
v2.2.7
v2.2.6
v2.2.2
v2.2.1
v2.2.0
v2.1.2
v2.1.0
v2.0.6
v2.0.5
v2.0.4
v2.0.3
v2.0.2
v2.0.1
v2.0.0
v1.22.1
v1.22.0
v1.21.0
v1.20.0
v1.19.0
v1.18.1
v1.18.0
v1.17.0
v1.16.0
v1.15.2
v1.15.1
v1.15.0
v1.14.4
v1.14.1
v1.14.0
v1.13.0
v1.12.2
v1.12.1
v1.12.0
v1.11.1
v1.11.0
v1.10.0
v1.9.0
v1.8.1
v1.8.0
v1.7.0
v1.6.5
v1.6.1
v1.6.0
v1.5.1
v1.5.0
v1.4.4
v1.4.3
v1.4.0
v1.3.0
v1.2.1
v1.2.0
v1.1.0
v1.0.0
v0.0.6
v0.0.5
v0.0.4
v0.0.3
v0.0.2
v0.0.1
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/android#1164
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @SergeantConfused on GitHub (Dec 28, 2020).
Originally assigned to: @mpbw2 on GitHub.
Describe the Bug
The Bitwarden Android client does not lock and require unlocking via master password or Biometrics after the Vault Timeout duration passes. Tested with 1, 5, and 15 minutes.
Steps To Reproduce
Expected Result
To be required to unlock the vault.
Actual Result
Vault is unlocked.
Screenshots or Videos
N/A.
Environment
Additional Context
N/A.
@steve-gombos commented on GitHub (Dec 28, 2020):
I also was having this issue.
@cdemi commented on GitHub (Dec 28, 2020):
Having this issue as well:
I think it has something to do with #1048
@cscharf commented on GitHub (Dec 29, 2020):
That change was pretty benign and had to do with behavior after the vault was locked... it's more than likely somewhere within https://github.com/bitwarden/mobile/pull/1175. We're looking into this further.
@steve-gombos commented on GitHub (Dec 29, 2020):
I pulled down the code and have been digging around. I think it is related to the changes from https://github.com/bitwarden/mobile/pull/1175 and specifically with the scenario of closing the application completely then opening it again. If you leave the app running in the background, then come back to it after the timeout, it will lock properly.
@cdemi commented on GitHub (Dec 29, 2020):
Yes #1175 looks more likely
@tehniemer commented on GitHub (Jan 4, 2021):
I'm having this issue with a OnePlus 6 on Android 10
@tehniemer commented on GitHub (Jan 4, 2021):
This comment got me thinking, I excluded the app from all battery optimization and it's back to locking as expected again.
@jlzizmor commented on GitHub (Jan 4, 2021):
i'm having the same issue on a Samsung Galaxy S9 on Android 10.
@tehniemer , have you seen any negative effects of excluding the app from battery optimization?
@tehniemer commented on GitHub (Jan 4, 2021):
@jlzizmor I just excluded this morning so I don't have any long term data.
@steffenw94 commented on GitHub (Jan 7, 2021):
I have same issue on Google Pixel 3a.
Sometimes the vault is locking, sometimes not.
For me i wait for fix to use this app again because i think this is high security lack
@mpbw2 commented on GitHub (Jan 7, 2021):
@steffenw94 is your Pixel 3a fully updated with the latest Android build & security updates? Also are you running with any particular power management functions enabled, like battery saver, or the new extreme battery saver, or some 3rd party tool?
To everyone else: I'm not ignoring you, just trying to reproduce this and I have access to the 3a (plus a 4a and a Galaxy S10 if anybody can reproduce this with those)
@matthewarmand commented on GitHub (Jan 7, 2021):
@mportune-bw I also have a Pixel 3a and am experiencing this if you need some extra reproduction/testing at some stage. I keep the device and security patches as up to date as I can, here's where mine is at currently:
Build number: RQ1A.201205.003
Android version: 11
Security update: 5 December 2020
Adaptive Battery and Battery Optimization are enabled, Battery Saver turns on at 10% but typically isn't on, and I am not currently using the new Extreme Battery Saver under any case.
@jjgithub19 commented on GitHub (Jan 7, 2021):
I started having the same issue on my Samsung Galaxy S8 as does my wife on her Moto G8 Power. Both phones are up-to-date with the latest builds and security updates. No special power management or battery saver tools are running on either phone. I tested excluding the Bitwarden app from Samsung's battery optimization but that didn't fix the issue.
Galaxy S8 Unlocked:
Model number: SM-G950U1
Android 9
Build number: PPR1.180610.011.G950U1UES8DTJ1
Android security patch level: October 1, 2020
Moto G8 Power Unlocked
Model number: XT2041-4
Android 10
Build number: QPMS30.80-63-6-8-3
Android security patch level: November 1, 2020
@tehniemer commented on GitHub (Jan 7, 2021):
To follow up, excluding from battery optimization was only a temporary fix for me, it's reverted to the behavior in this issue.
@mpbw2 commented on GitHub (Jan 7, 2021):
Thanks everyone for the info. @matthewarmand What is your vault timeout and timeout action set to? Are you using bio and/or PIN to unlock?
@matthewarmand commented on GitHub (Jan 7, 2021):
Vault timeout is set to 15 minutes, action is set to Lock. I'm using neither bio nor pin, just master password to unlock.
@mpbw2 commented on GitHub (Jan 7, 2021):
Can everyone here try clearing app data (or uninstall/reinstall) and see if that changes anything? (I'm curious about the behavior of a particular stored pref)
@jjgithub19 commented on GitHub (Jan 7, 2021):
I just tested...
UPDATE: I was doing some other stuff and then just went back over to my phone. I unlocked my phone and forgot I still had Bitwarden open... it was prompting for me to login. So maybe it didn't lock right after the 1 minute mark, but it did lock.
@matthewarmand commented on GitHub (Jan 7, 2021):
@mportune-bw I uninstalled and reinstalled, unlocked, waiting 16 minutes, and the vault did auto-lock. It's been an hour or so, so I'm going to keep trying over the next several hours and if I notice it failing to lock again I'll let you know, but for the moment a full reinstall seems to have done the trick on my device.
@mpbw2 commented on GitHub (Jan 7, 2021):
Thank you both, this is very helpful. @jimmyj352 How long (approximately) after the 1 minute mark did you attempt to unlock on your initial test?
@jjgithub19 commented on GitHub (Jan 7, 2021):
@mportune-bw I just checked again and it still hasn't locked after probably 2-3 minutes of inactivity. I'm going to clear the app data on my wife's phone and see how it goes there. I'll let you know shortly.
@jlzizmor commented on GitHub (Jan 7, 2021):
@mportune-bw I tried uninstalling and re-installing. I changed the timeout to 5 minutes (how I usually keep it) from the default of 15 minutes, waited 5 minutes, and it was still locked. I'm now waiting another 15 minutes to see if the change to a 5-minute timeout wasn't processed.
@jjgithub19 commented on GitHub (Jan 7, 2021):
@mportune-bw Just completed the same test on my wife's Moto G8 with clearing the app data. Logged back in, set the auto-lock to 1 minute, and then backed out of the app. I set a timer for 1 minute and went back to Bitwarden and it was locked so that's a good thing.
@mpbw2 commented on GitHub (Jan 7, 2021):
Quick sanity check to make sure everyone is running 2.7.2 for this experiment (we halted the rollout so not everyone may have it yet - you can sign up for the beta in the Play Store if you don't)
@matthewarmand commented on GitHub (Jan 7, 2021):
2.7.2 confirmed here. Should have checked that before the re-install, but if 2.7.2 came out anymore before the last day or two I was probably updated to it
@jlzizmor commented on GitHub (Jan 7, 2021):
@mportune-bw after 15 minutes going back into the app it was still unlocked. On the off chance that there's a difference, I'll try clearing the app data and run the same test.
The "About" popup says that I'm running "2.7.2 (3300)"
@jjgithub19 commented on GitHub (Jan 7, 2021):
@mportune-bw Good call on the version check.
My wife is still running 2.6.1 on the Moto G8 Power that is working fine with the auto-lock now.
My Samsung Galaxy S8 is running 2.7.2 and is still having the issue. I have the auto-lock set for 1 minute and then keep setting a timer. I checked after 1 minute... still unlocked. Set a timer for 2 minutes and then checked... still unlocked. I'm up to a 5-minute timer and it's still not locking.
@jjgithub19 commented on GitHub (Jan 7, 2021):
So, I just noticed something that seems to line up with what happened earlier during my first test. I just went to my phone (it's only been a couple of minutes) and hadn't backed out of the app so Bitwarden was front and center. It prompted me to login. That was the same thing that happened with my first test when it seemed like the auto-lock was working. In other words, it's looking like if Bitwarden is active, it can process the auto-locking but if it's in the background it can't. I'm guessing you already know this, but thought I'd share regardless.
Let me know if you want me to test anything further.
@mpbw2 commented on GitHub (Jan 7, 2021):
@jimmyj352 Just to confirm - Bitwarden was the foreground app but the screen was off (device sleep) while waiting, correct?
@jlzizmor commented on GitHub (Jan 7, 2021):
i cleared the app data, signed back in, changed the timeout to 5 minutes. then i got distracted and didn't set my timer right away so i was away from the app for well more than 5 minutes, but when i returned it did prompt me for my code
@jjgithub19 commented on GitHub (Jan 7, 2021):
That is correct - both times that the auto-lock worked successfully.
@rsngfrce commented on GitHub (Jan 9, 2021):
If it matters, I believe I am the one who originally reported this issue on my Galaxy S10e. I reverted to 2.7.0 from 2.7.2 and have not had the issue since. Another user confirmed this issue to me, but reported that the vault WOULD lock if set to immediate (as opposed to a to time length).
@rfoliva commented on GitHub (Jan 9, 2021):
I can confirm setting lock to immediately as a workaround for me as well.
On Sat., Jan. 9, 2021, 11:08 a.m. rsngfrce, notifications@github.com
wrote:
@jerheij commented on GitHub (Jan 11, 2021):
I have start noticing this issue happening to my Bitwarden Android app as well.
Samsung Galaxy S10+ (locked/unrooted)
Model number: SM-G975F
Android: 10
Security patch: 1-12-2020
Bitwarden app: 2.7.2(3300)
Samsung Tab s5e
Android: 10
Bitwarden app: 2.7.2(3300)
@matthewarmand commented on GitHub (Jan 11, 2021):
As an update btw, the reinstall was a temporary fix and my Pixel 3a has started "not locking" again 😢
@rfoliva commented on GitHub (Jan 13, 2021):
@jerheij and @matthewarmand - setting Timeout Action to Immediately should work for now. At least, it does for me on Android.
Otherwise, we need to wait for new release.
@markangus2b commented on GitHub (Jan 14, 2021):
Same issue on the Pixel 2XL.
@mpbw2 commented on GitHub (Jan 15, 2021):
Everyone, version 2.7.3 has just been pushed to the beta channel on the Play Store (it usually takes Google a few hours to approve it). You can also grab the build directly from here if you don't want to wait (scroll down to Artifacts). If you could give this a whirl over the weekend and report back I'd appreciate it.
@jjgithub19 commented on GitHub (Jan 16, 2021):
@mportune-bw Downloaded the beta (2.7.3) from your Github link, installed, and verified the version number. I set the timeout for a minute, hit the home button, and tested after a minute - it was locked as it should be. Changed the timeout to 15 minutes and did the same... success. From what I'm seeing, it looks like the problem has been fixed - thank you!
@matthewarmand commented on GitHub (Jan 16, 2021):
@mportune-bw I signed up for the beta and got the new version that way, have tested a couple times and everything seems smooth so far. I'll keep an eye on it over the weekend and let you know if I notice anything off
@cdemi commented on GitHub (Jan 16, 2021):
I have downloaded the beta from the Play Store and can also confirm that the fix is working so far!
@rsngfrce commented on GitHub (Jan 16, 2021):
Samsung Galaxy S10e, Android 10
I was unable to update from 2.7.0, which I had reverted to from APKMIRROR, either from here or by signing up for the beta on the Play Store because I got the message, "Security policy prevents updating this application." This is a personal phone and I have never seen that message before.
I had to uninstall Bitwarden and then I was able to install the beta from the Play Store, which has been working fine so far.
@mpbw2 commented on GitHub (Jan 17, 2021):
Thanks everyone for the feedback, glad to hear it's working.
@rsngfrce I'm not sure what would cause that unless Google Play refuses to update an APK installation with an AAB (bundle) installation, or maybe the APK from APKMIRROR was the F-Droid version which is signed with a different release key to prevent accidental overwrites by the Play Store.
@tehniemer commented on GitHub (Jan 17, 2021):
Play store beta seems to fix the issue for me, it's been 12+ hours.
@jerheij commented on GitHub (Jan 17, 2021):
I installed the beta on both the devices, set it to one minute lock and both seemed to work as intented.
@simonai1254 commented on GitHub (Jan 18, 2021):
I could reproduce this issue as well on the following device (already reported via mail):
Samsung Galaxy Note 8 (not rooted)
Android 9
Security Patch: 2020-10-01
Bitwarden App: 2.7.2(3300)
Bitwarden Timeout: 15 minutes
Biometric Login: Enabled
Power Saving: No special power saving restrictions enabled, using system default settings.
I openend Bitwarden, copied a password and used it elsewhere and continued using the phone. After 30 minutes (Bitwarden in Background and/or phone screen turned off) when trying to access another password I could retrieve it without being prompted to authenticate.
Now after joining the Beta the update to 2.7.3 (3335) and changing the Lockout Time to 1 Minute the app seems to behave correctly. Now I've switched it back to 15 minutes and will continue to monitor the behavior.
Regards
@mpbw2 commented on GitHub (Jan 19, 2021):
Thanks again everyone, closing this issue now. We're planning to push releases this week and this will be included.