github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-05-07 12:34:03 -05:00
Code Issues 266 Packages Projects Releases 82 Wiki Activity

[GH-ISSUE #6565] Excessive requests to /api/tasks (IP ban) #19243

New Issue
Closed
opened 2026-04-25 21:45:21 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-25 21:45:21 -05:00
Owner
Copy Link

Originally created by @nathgoat on GitHub (Dec 17, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6565

Prerequisites

Vaultwarden Support String

I am using Vaultwarden and my server eventually bans my client IP due to excessive requests.

This happens:

  • with the browser extension
  • and also with the desktop application
    So it does not appear to be extension-specific.

Observed behavior:

  • Everything works normally at first
  • After some time, the client repeatedly sends requests to /api/tasks
  • The server responds with 404
  • Requests continue and trigger an IP ban

Error seen in server logs:

[17/Dec/2025:08:39:27 +0100] - 404 404 - GET https domain.tld "/api/tasks" [Client X.X.X.X] [Length 677] [Gzip 2.41] [Sent-to X.X.X.X] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-"

Scope:

  • Currently affecting 2 users
  • Other users on the same Vaultwarden instance are not affected so far

Expected behavior:

  • The client should not retry indefinitely after 404 responses
  • Normal usage should not result in IP bans

Vaultwarden Build Version

2025.12.0

Deployment method

Official Container Image

Custom deployment method

Yes. Vaultwarden is deployed using Docker behind a reverse proxy with rate limiting enabled.
No other custom modifications have been applied to Vaultwarden itself.

Reverse Proxy

.

Host/Server Operating System

Linux

Operating System Version

Debian 12

Clients

Browser Extension

Client Version

Edge 143.0.3650.80

Steps To Reproduce

Install and use Vaultwarden normally (extension or desktop app)
Log in and access the vault
Leave the client running for some time
Observe repeated GET requests to /api/tasks returning 404
Client IP eventually gets banned by server-side protections

Expected Result

The client should not repeatedly retry after persistent 404 responses, and normal usage should not trigger IP bans.

Actual Result

The client continuously sends requests to /api/tasks returning 404, triggering rate limiting and an IP ban.

Logs

[17/Dec/2025:08:39:27 +0100] - 404 404 - GET https domain.tld "/api/tasks" [Client X.X.X.X] [Length 677] [Gzip 2.41] [Sent-to X.X.X.X] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-"

Screenshots or Videos

Additional Context

No response

Originally created by @nathgoat on GitHub (Dec 17, 2025). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6565 ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String I am using Vaultwarden and my server eventually bans my client IP due to excessive requests. This happens: - with the browser extension - and also with the desktop application So it does not appear to be extension-specific. Observed behavior: - Everything works normally at first - After some time, the client repeatedly sends requests to /api/tasks - The server responds with 404 - Requests continue and trigger an IP ban Error seen in server logs: ------------------------------------------------------------------------- [17/Dec/2025:08:39:27 +0100] - 404 404 - GET https domain.tld "/api/tasks" [Client X.X.X.X] [Length 677] [Gzip 2.41] [Sent-to X.X.X.X] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-" ------------------------------------------------------------------------- Scope: - Currently affecting 2 users - Other users on the same Vaultwarden instance are not affected so far Expected behavior: - The client should not retry indefinitely after 404 responses - Normal usage should not result in IP bans ### Vaultwarden Build Version 2025.12.0 ### Deployment method Official Container Image ### Custom deployment method Yes. Vaultwarden is deployed using Docker behind a reverse proxy with rate limiting enabled. No other custom modifications have been applied to Vaultwarden itself. ### Reverse Proxy . ### Host/Server Operating System Linux ### Operating System Version Debian 12 ### Clients Browser Extension ### Client Version Edge 143.0.3650.80 ### Steps To Reproduce Install and use Vaultwarden normally (extension or desktop app) Log in and access the vault Leave the client running for some time Observe repeated GET requests to /api/tasks returning 404 Client IP eventually gets banned by server-side protections ### Expected Result The client should not repeatedly retry after persistent 404 responses, and normal usage should not trigger IP bans. ### Actual Result The client continuously sends requests to /api/tasks returning 404, triggering rate limiting and an IP ban. ### Logs ```text [17/Dec/2025:08:39:27 +0100] - 404 404 - GET https domain.tld "/api/tasks" [Client X.X.X.X] [Length 677] [Gzip 2.41] [Sent-to X.X.X.X] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-" ``` ### Screenshots or Videos ### Additional Context _No response_
GiteaMirror added the bug label 2026-04-25 21:45:21 -05:00
GiteaMirror commented 2026-04-25 21:45:22 -05:00
Author
Owner
Copy Link

@stefan0xC commented on GitHub (Dec 17, 2025):

That endpoint was added already in #6557 and is available in the current testing image. If you don't want to use that you should downgrade your clients until there's a new release.

<!-- gh-comment-id:3664929401 --> @stefan0xC commented on GitHub (Dec 17, 2025): That endpoint was added already in #6557 and is available in the current `testing` image. If you don't want to use that you should downgrade your clients until there's a new release.
GiteaMirror commented 2026-04-25 21:45:23 -05:00
Author
Owner
Copy Link

@BlackDex commented on GitHub (Dec 17, 2025):

Closing as resolved via #6557

<!-- gh-comment-id:3665392281 --> @BlackDex commented on GitHub (Dec 17, 2025): Closing as resolved via #6557
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#19243
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?