Create new login item or edit existing one and save.
Expected Result
Successful save/edit operation.
Actual Result
The extension shows an error and completely logs out.
Logs
[2026-02-22 10:06:03.380][response][INFO] (put_cipher) PUT /api/ciphers/<cipher_id> => 401 Unauthorized
[2026-02-22 10:06:03.380][vaultwarden::api::core::ciphers::_][WARN] Request guard `Headers` failed: "No access token provided".
[2026-02-22 10:06:03.380][auth][ERROR] Unauthorized Error: No access token provided
[2026-02-22 10:06:03.380][request][INFO] PUT /api/ciphers/<cipher_id>
Screenshots or Videos
No response
Additional Context
It works normally in the desktop client.
I had an outdated Vaultwarden instance for a while and updated it today just to get this issue. Don't know if skipping versions can cause it.
I installed the browser extension on Brave for the first time today to test and got the same issue.
I tried re-installing in Firefox, same issue.
For the diagnostics, it showed a fail for headers, so I changed the config value from X-Real-IP to X-Forwarded-For hoping it might help, but to no avail. Don't know if it is relevant.
Originally created by @mostafa-abdelbrr on GitHub (Feb 22, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6858
### Prerequisites
- [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
- [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
### Vaultwarden Support String
### Your environment (Generated via diagnostics page)
* Vaultwarden version: v1.35.3
* Web-vault version: v2026.1.1
* OS/Arch: linux/x86_64
* Running within a container: false (Base: Not applicable)
* Database type: PostgreSQL
* Database version: PostgreSQL 15.1 (Ubuntu 15.1-1.pgdg20.04+1) on aarch64-unknown-linux-gnu, compiled by gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0, 64-bit
* Uses config.json: false
* Uses a reverse proxy: true
* IP Header check: true (X-Forwarded-For)
* Internet access: true
* Internet access via a proxy: false
* DNS Check: true
* Browser/Server Time Check: true
* Server/NTP Time Check: true
* Domain Configuration Check: true
* HTTPS Check: true
* Websocket Check: true
* HTTP Response Checks: false
### Config & Details (Generated via diagnostics page)
<details><summary>Show Config & Details</summary>
**Failed HTTP Checks:**
```yaml
API calls:
Header: 'content-security-policy' does not contain 'default-src 'none''
```
**Config:**
```json
{
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": false,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "***:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_idle_timeout": 600,
"database_max_conns": 2,
"database_min_conns": 2,
"database_timeout": 30,
"database_url": "********://***************************************************************************************************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"dns_prefer_ipv6": false,
"domain": "*****://*************************************",
"domain_origin": "*****://*************************************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": true,
"ip_header": "X-Forwarded-For",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"purge_incomplete_sso_auth": "0 20 0 * * *",
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": false,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": null,
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "",
"smtp_from_name": "***********",
"smtp_host": null,
"smtp_password": null,
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": null,
"sso_allow_unknown_email_verification": false,
"sso_audience_trusted": null,
"sso_auth_only_not_session": false,
"sso_authority": "",
"sso_authorize_extra_params": "",
"sso_callback_path": "*****://******************************************************************",
"sso_client_cache_expiration": 0,
"sso_client_id": "",
"sso_client_secret": "***",
"sso_debug_tokens": false,
"sso_enabled": false,
"sso_master_password_policy": null,
"sso_only": false,
"sso_pkce": true,
"sso_scopes": "email profile",
"sso_signups_match_email": true,
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}
```
</details>
### Vaultwarden Build Version
v1.35.3
### Deployment method
Official Container Image
### Custom deployment method
I deploy to free a Render instance.
This is the public repo that details how to do it:
https://github.com/mostafa-abdelbrr/vaultwarden-render
### Reverse Proxy
Render's default
### Host/Server Operating System
Linux
### Operating System Version
_No response_
### Clients
Browser Extension
### Client Version
Firefox 2025.12.1, Brave 2026.1.1
### Steps To Reproduce
Create new login item or edit existing one and save.
### Expected Result
Successful save/edit operation.
### Actual Result
The extension shows an error and completely logs out.
### Logs
```text
[2026-02-22 10:06:03.380][response][INFO] (put_cipher) PUT /api/ciphers/<cipher_id> => 401 Unauthorized
[2026-02-22 10:06:03.380][vaultwarden::api::core::ciphers::_][WARN] Request guard `Headers` failed: "No access token provided".
[2026-02-22 10:06:03.380][auth][ERROR] Unauthorized Error: No access token provided
[2026-02-22 10:06:03.380][request][INFO] PUT /api/ciphers/<cipher_id>
```
### Screenshots or Videos
_No response_
### Additional Context
It works normally in the desktop client.
I had an outdated Vaultwarden instance for a while and updated it today just to get this issue. Don't know if skipping versions can cause it.
I installed the browser extension on Brave for the first time today to test and got the same issue.
I tried re-installing in Firefox, same issue.
For the diagnostics, it showed a fail for headers, so I changed the config value from `X-Real-IP` to `X-Forwarded-For` hoping it might help, but to no avail. Don't know if it is relevant.
GiteaMirror
added the bug label 2026-04-25 21:53:14 -05:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @mostafa-abdelbrr on GitHub (Feb 22, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6858
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Failed HTTP Checks:
Config:
Vaultwarden Build Version
v1.35.3
Deployment method
Official Container Image
Custom deployment method
I deploy to free a Render instance.
This is the public repo that details how to do it:
https://github.com/mostafa-abdelbrr/vaultwarden-render
Reverse Proxy
Render's default
Host/Server Operating System
Linux
Operating System Version
No response
Clients
Browser Extension
Client Version
Firefox 2025.12.1, Brave 2026.1.1
Steps To Reproduce
Create new login item or edit existing one and save.
Expected Result
Successful save/edit operation.
Actual Result
The extension shows an error and completely logs out.
Logs
Screenshots or Videos
No response
Additional Context
It works normally in the desktop client.
I had an outdated Vaultwarden instance for a while and updated it today just to get this issue. Don't know if skipping versions can cause it.
I installed the browser extension on Brave for the first time today to test and got the same issue.
I tried re-installing in Firefox, same issue.
For the diagnostics, it showed a fail for headers, so I changed the config value from
X-Real-IPtoX-Forwarded-Forhoping it might help, but to no avail. Don't know if it is relevant.