github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-06 07:48:22 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #5905] [BWA-194] communication to localhost not permitted by network security policy #28242

New Issue
Closed
opened 2026-04-18 12:12:55 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-18 12:12:55 -05:00
Owner
Copy Link

Originally created by @iwan-uschka on GitHub (Sep 18, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/5905

Steps To Reproduce

  1. Run https://github.com/bitwarden/server on a local machine at localhost:2890 (i am running https://github.com/dani-garcia/vaultwarden via Docker on macOS)
  2. Connect Android Smartphone via USB to the local machine running the server.
  3. Configure ADB reverse port forwarding on the local machine to enable Bitwarden app on Android accessing the locally running server (localhost:2890): adb reverse tcp:2890 tcp:2890
  4. Log into account in Bitwarden Android app (select "self hosted" and use "http://localhost:2890" and correct credentials).

Expected Result

It did work before updating the app (don't know the previous version unfortunately) and it surely works in outdated v2024.10.0 (running on an old Android phone).

Actual Result

It fails in v2025.8.1.

Stacktrace:

java.net.UnknownServiceException: CLEARTEXT communication to localhost not permitted by network security policy
Ad.v.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:65)
Ad.v.a(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:679)
Ad.v.g(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:155)
Ad.m.d(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:10)
Ad.m.a(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:62)
Ad.b.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:24)
Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128)
Bd.b.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:608)
Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128)
Bd.a.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:541)
Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128)
Bd.a.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:199)
Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128)
Md.b.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:554)
Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128)
com.bitwarden.network.interceptor.BaseUrlInterceptor.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:43)
Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128)
com.bitwarden.network.interceptor.HeadersInterceptor.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:47)
Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128)
Ad.r.d(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:90)
Ad.o.run(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:48)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
java.lang.Thread.run(Thread.java:923)

Version: 2025.8.1 (20670)
Device: 📱 motorola Moto G (5) 🤖 11@30 📦 prod
CI: 🧱 commit: bitwarden/android/release/2025.8-rc33@b497156302a73fd2b14de16106dc218c30ec1702
💻 build source: bitwarden/android/actions/runs/17277676605/attempts/1

Screenshots or Videos

No response

Additional Context

No response

Build Version

2025.8.1

What server are you connecting to?

Self-host

Self-host Server Version

https://github.com/bitwarden/server/releases/tag/v2025.8.1

Environment Details

No response

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @iwan-uschka on GitHub (Sep 18, 2025). Original GitHub issue: https://github.com/bitwarden/android/issues/5905 ### Steps To Reproduce 1. Run https://github.com/bitwarden/server on a local machine at localhost:2890 (i am running https://github.com/dani-garcia/vaultwarden via Docker on macOS) 2. Connect Android Smartphone via USB to the local machine running the server. 3. Configure ADB reverse port forwarding on the local machine to enable Bitwarden app on Android accessing the locally running server (localhost:2890): `adb reverse tcp:2890 tcp:2890` 4. Log into account in Bitwarden Android app (select "self hosted" and use "http://localhost:2890" and correct credentials). ### Expected Result It did work before updating the app (don't know the previous version unfortunately) and it surely works in outdated v2024.10.0 (running on an old Android phone). ### Actual Result It fails in v2025.8.1. Stacktrace: ``` java.net.UnknownServiceException: CLEARTEXT communication to localhost not permitted by network security policy Ad.v.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:65) Ad.v.a(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:679) Ad.v.g(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:155) Ad.m.d(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:10) Ad.m.a(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:62) Ad.b.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:24) Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128) Bd.b.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:608) Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128) Bd.a.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:541) Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128) Bd.a.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:199) Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128) Md.b.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:554) Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128) com.bitwarden.network.interceptor.BaseUrlInterceptor.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:43) Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128) com.bitwarden.network.interceptor.HeadersInterceptor.intercept(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:47) Bd.h.b(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:128) Ad.r.d(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:90) Ad.o.run(r8-map-id-952a9e49ac6df5bb0f31f998a86395034d25aa88233ad3f49d0f2d5293031f08:48) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) java.lang.Thread.run(Thread.java:923) ``` Version: 2025.8.1 (20670) Device: 📱 motorola Moto G (5) 🤖 11@30 📦 prod CI: 🧱 commit: bitwarden/android/release/2025.8-rc33@b497156302a73fd2b14de16106dc218c30ec1702 💻 build source: bitwarden/android/actions/runs/17277676605/attempts/1 ### Screenshots or Videos _No response_ ### Additional Context _No response_ ### Build Version 2025.8.1 ### What server are you connecting to? Self-host ### Self-host Server Version https://github.com/bitwarden/server/releases/tag/v2025.8.1 ### Environment Details _No response_ ### Issue Tracking Info - [ ] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the app:authenticatorbug labels 2026-04-18 12:12:55 -05:00
GiteaMirror commented 2026-04-18 12:12:58 -05:00
Author
Owner
Copy Link

@bitwarden-bot commented on GitHub (Sep 18, 2025):

Thank you for your report! We've added this to our internal board for review.
ID: BWA-194

<!-- gh-comment-id:3306064013 --> @bitwarden-bot commented on GitHub (Sep 18, 2025): Thank you for your report! We've added this to our internal board for review. ID: BWA-194
GiteaMirror commented 2026-04-18 12:13:00 -05:00
Author
Owner
Copy Link

@Adedamola-Aina commented on GitHub (Sep 18, 2025):

Hello @iwan-uschka

HTTPS now required on Android: The Android Password Manager app now requires connection to a server using HTTPS. This change will only affect users who are self-hosting a Bitwarden server without a SSL/TLS certificate. Learn more about certificates here.

<!-- gh-comment-id:3306384985 --> @Adedamola-Aina commented on GitHub (Sep 18, 2025): Hello @iwan-uschka HTTPS now required on Android: The Android Password Manager app now requires connection to a server using HTTPS. This change will only affect users who are self-hosting a Bitwarden server without a SSL/TLS certificate. Learn more about certificates [here](https://bitwarden.com/help/certificates/).
GiteaMirror commented 2026-04-18 12:13:01 -05:00
Author
Owner
Copy Link

@iwan-uschka commented on GitHub (Sep 18, 2025):

Thanks @Adedamola-Aina for the quick reply. It helped a lot!

If anyone stumbles upon this issue, here is what i did to make it work (no recommendation):

  • brew install caddy (https://caddyserver.com/)
  • caddy reverse-proxy --from localhost:2891 --to localhost:2890 => create simple reverse proxy with HTTPS (caddy handles TLS certificates)
  • copy certificate Caddy Local Authority - 2025 ECC Root to the Android device
  • connect Android device to local machine via USB
  • adb reverse tcp:2890 tcp:2891
  • run setup in Bitwarden Android app, select "self-hosted", add the server URL "https://localhost:2890" and credentials
  • stop Caddy

Now every time i want to sync the vault i need to

  • caddy reverse-proxy --from localhost:2891 --to localhost:2890
  • connect Android device to local machine via USB
  • adb reverse tcp:2890 tcp:2891
  • click on sync in the Bitwarden Android app
  • stop Caddy

If anyone knows a better way of syncing the vault from a local machine to an Android device, please let me know :)

<!-- gh-comment-id:3306747886 --> @iwan-uschka commented on GitHub (Sep 18, 2025): Thanks @Adedamola-Aina for the quick reply. It helped a lot! If anyone stumbles upon this issue, here is what i did to make it work (no recommendation): - `brew install caddy` (https://caddyserver.com/) - `caddy reverse-proxy --from localhost:2891 --to localhost:2890` => create simple reverse proxy with HTTPS (caddy handles TLS certificates) - copy certificate `Caddy Local Authority - 2025 ECC Root` to the Android device - connect Android device to local machine via USB - `adb reverse tcp:2890 tcp:2891` - run setup in Bitwarden Android app, select "self-hosted", add the server URL "https://localhost:2890" and credentials - stop Caddy Now every time i want to sync the vault i need to - `caddy reverse-proxy --from localhost:2891 --to localhost:2890` - connect Android device to local machine via USB - `adb reverse tcp:2890 tcp:2891` - click on sync in the Bitwarden Android app - stop Caddy If anyone knows a better way of syncing the vault from a local machine to an Android device, please let me know :)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label app:authenticator bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#28242
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?