github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-07 19:39:41 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #4629] Passkey login does not work when setting "Session timeout" to "Immediately" #28037

New Issue
Closed
opened 2026-04-18 11:50:27 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-18 11:50:27 -05:00
Owner
Copy Link

Originally created by @hep-mh on GitHub (Jan 26, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/4629

Steps To Reproduce

  1. Save any passkey in Bitwarden
  2. In Bitwarden settings, set "Session timeout" to "Immediately"
  3. Try to use the passkey to login
  4. Authenticate via biometrics to unlock the vault
  5. Choose the desired passkey from the list
  6. Authenticate via biometrics to use the passkey

Expected Result

The login should work.
Also, it should only be required to authenticate via biometrics once.

Actual Result

The login fails, most likely because Bitwarden locks the vault before the authentication process is finished.
Also, the user needs to authenticate twice via biometrics.

Screenshots or Videos

In the video below, screen capture for Bitwarden was block in order to hide sensitive information. To compensate, I also appended a screenshot of the error message shown in Bitwarden.

https://github.com/user-attachments/assets/4c65bcbd-fae5-41af-ad34-c055498e2b0a

Image

Additional Context

The same problem happens when setting "Session timeout" to "On app restart", while not having the app open in the background.

Together with #4436 this does not allow for the usage of passkeys with strong vault security.

Build Version

Version: 2025.1.0 (19622)

What server are you connecting to?

US

Self-host Server Version

No response

Environment Details

Google Pixel 6
Android 15
API level 35

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @hep-mh on GitHub (Jan 26, 2025). Original GitHub issue: https://github.com/bitwarden/android/issues/4629 ### Steps To Reproduce 1. Save any passkey in Bitwarden 2. In Bitwarden settings, set "Session timeout" to "Immediately" 3. Try to use the passkey to login 4. Authenticate via biometrics to unlock the vault 5. Choose the desired passkey from the list 6. Authenticate via biometrics to use the passkey ### Expected Result The login should work. Also, it should only be required to authenticate via biometrics once. ### Actual Result The login fails, most likely because Bitwarden locks the vault before the authentication process is finished. Also, the user needs to authenticate twice via biometrics. ### Screenshots or Videos In the video below, screen capture for Bitwarden was block in order to hide sensitive information. To compensate, I also appended a screenshot of the error message shown in Bitwarden. https://github.com/user-attachments/assets/4c65bcbd-fae5-41af-ad34-c055498e2b0a ![Image](https://github.com/user-attachments/assets/b2ad68d9-e6dd-487c-9ebc-d66315fac59b) ### Additional Context The same problem happens when setting "Session timeout" to "On app restart", while not having the app open in the background. Together with #4436 this does not allow for the usage of passkeys with strong vault security. ### Build Version Version: 2025.1.0 (19622) ### What server are you connecting to? US ### Self-host Server Version _No response_ ### Environment Details Google Pixel 6 Android 15 API level 35 ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the bug label 2026-04-18 11:50:27 -05:00
GiteaMirror commented 2026-04-18 11:50:29 -05:00
Author
Owner
Copy Link

@bitwarden-bot commented on GitHub (Jan 26, 2025):

Thank you for your report! We've added this to our internal board for review.
ID: PM-17580

<!-- gh-comment-id:2614409482 --> @bitwarden-bot commented on GitHub (Jan 26, 2025): Thank you for your report! We've added this to our internal board for review. ID: PM-17580
GiteaMirror commented 2026-04-18 11:50:30 -05:00
Author
Owner
Copy Link

@SaintPatrck commented on GitHub (Jan 27, 2025):

Hi @hep-mh

I'm happy to inform you this issue has been resolved and the fix will be in an upcoming release. For reference, the issue was resolved in #4547 with the implementation of single-tap passkey operations.

There is still a known issue that forces users to authenticate twice due to the nature of how "Immediate" vault locking works and we're actively investigating solutions to improve that user experience.

I'll be closing this ticket since the described issue has been resolved. If you continue having issues please let us know or contact support.

<!-- gh-comment-id:2617090582 --> @SaintPatrck commented on GitHub (Jan 27, 2025): Hi @hep-mh I'm happy to inform you this issue has been resolved and the fix will be in an upcoming release. For reference, the issue was resolved in #4547 with the implementation of single-tap passkey operations. There is still a known issue that forces users to authenticate twice due to the nature of how "Immediate" vault locking works and we're actively investigating solutions to improve that user experience. I'll be closing this ticket since the described issue has been resolved. If you continue having issues please let us know or contact support.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#28037
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?