github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-06 07:48:22 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[PR #6545] [MERGED] [PM-32356] Fix: Use soft logout for token refresh failures to preserve account #48265

New Issue
Closed
opened 2026-04-26 15:51:20 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-26 15:51:20 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/6545
Author: @hwittenborn
Created: 2/16/2026
Status: ✅ Merged
Merged: 2/19/2026
Merged by: @david-livefront

Base: main ← Head: fix/token-refresh-soft-logout

📝 Commits (3)

  • cc083ec Fix: Use soft logout for token refresh failures to preserve account
  • 2a8cc5b Format lines
  • 3cfa13e Update tests

📊 Changes

2 files changed (+19 additions, -6 deletions)

View changed files

📝 app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryImpl.kt (+12 -3)
📝 app/src/test/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryTest.kt (+7 -3)

📄 Description

📔 Objective

When a refresh token expires or becomes invalid, the app was performing
a hard logout which completely removed the account from the account list.
This caused users to be automatically switched to another account and
forced them to re-add their server URL and account details.

This change uses softLogout() instead of logout() when token refresh
fails, which:

  • Keeps the account in the account switcher
  • Preserves PIN and vault timeout settings
  • Allows users to simply re-authenticate with their password
  • Prevents unexpected account switching

This fixes the issue where users with multiple accounts (especially
those with self-hosted instances on private VPN networks) would lose
access to their accounts after being offline for extended periods.

Fixes token refresh error handling for:

  • InvalidGrant (expired refresh token)
  • RefreshForbidden (403 response)
  • RefreshUnauthorized (401 response)

Co-Authored-By: Claude noreply@anthropic.com

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/6545 **Author:** [@hwittenborn](https://github.com/hwittenborn) **Created:** 2/16/2026 **Status:** ✅ Merged **Merged:** 2/19/2026 **Merged by:** [@david-livefront](https://github.com/david-livefront) **Base:** `main` ← **Head:** `fix/token-refresh-soft-logout` --- ### 📝 Commits (3) - [`cc083ec`](https://github.com/bitwarden/android/commit/cc083ece9d6ac001777d8e40bd7ddfc7b8706397) Fix: Use soft logout for token refresh failures to preserve account - [`2a8cc5b`](https://github.com/bitwarden/android/commit/2a8cc5b499d676b8ceed1a4c0bb5dd2c5135f90f) Format lines - [`3cfa13e`](https://github.com/bitwarden/android/commit/3cfa13e24e132cb08c2f566e7a372473b0b90624) Update tests ### 📊 Changes **2 files changed** (+19 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryImpl.kt` (+12 -3) 📝 `app/src/test/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryTest.kt` (+7 -3) </details> ### 📄 Description ## 📔 Objective When a refresh token expires or becomes invalid, the app was performing a hard logout which completely removed the account from the account list. This caused users to be automatically switched to another account and forced them to re-add their server URL and account details. This change uses `softLogout()` instead of `logout()` when token refresh fails, which: - Keeps the account in the account switcher - Preserves PIN and vault timeout settings - Allows users to simply re-authenticate with their password - Prevents unexpected account switching This fixes the issue where users with multiple accounts (especially those with self-hosted instances on private VPN networks) would lose access to their accounts after being offline for extended periods. Fixes token refresh error handling for: - InvalidGrant (expired refresh token) - RefreshForbidden (403 response) - RefreshUnauthorized (401 response) Co-Authored-By: Claude <noreply@anthropic.com> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-26 15:51:20 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#48265
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?