Other users on the same Vaultwarden instance are not affected so far
Expected behavior:
The client should not retry indefinitely after 404 responses
Normal usage should not result in IP bans
Vaultwarden Build Version
2025.12.0
Deployment method
Official Container Image
Custom deployment method
Yes. Vaultwarden is deployed using Docker behind a reverse proxy with rate limiting enabled.
No other custom modifications have been applied to Vaultwarden itself.
Reverse Proxy
.
Host/Server Operating System
Linux
Operating System Version
Debian 12
Clients
Browser Extension
Client Version
Edge 143.0.3650.80
Steps To Reproduce
Install and use Vaultwarden normally (extension or desktop app)
Log in and access the vault
Leave the client running for some time
Observe repeated GET requests to /api/tasks returning 404
Client IP eventually gets banned by server-side protections
Expected Result
The client should not repeatedly retry after persistent 404 responses, and normal usage should not trigger IP bans.
Actual Result
The client continuously sends requests to /api/tasks returning 404, triggering rate limiting and an IP ban.
Originally created by @nathgoat on GitHub (Dec 17, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6565
### Prerequisites
- [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
- [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
### Vaultwarden Support String
I am using Vaultwarden and my server eventually bans my client IP due to excessive requests.
This happens:
- with the browser extension
- and also with the desktop application
So it does not appear to be extension-specific.
Observed behavior:
- Everything works normally at first
- After some time, the client repeatedly sends requests to /api/tasks
- The server responds with 404
- Requests continue and trigger an IP ban
Error seen in server logs:
-------------------------------------------------------------------------
[17/Dec/2025:08:39:27 +0100] - 404 404 - GET https domain.tld "/api/tasks" [Client X.X.X.X] [Length 677] [Gzip 2.41] [Sent-to X.X.X.X] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-"
-------------------------------------------------------------------------
Scope:
- Currently affecting 2 users
- Other users on the same Vaultwarden instance are not affected so far
Expected behavior:
- The client should not retry indefinitely after 404 responses
- Normal usage should not result in IP bans
### Vaultwarden Build Version
2025.12.0
### Deployment method
Official Container Image
### Custom deployment method
Yes. Vaultwarden is deployed using Docker behind a reverse proxy with rate limiting enabled.
No other custom modifications have been applied to Vaultwarden itself.
### Reverse Proxy
.
### Host/Server Operating System
Linux
### Operating System Version
Debian 12
### Clients
Browser Extension
### Client Version
Edge 143.0.3650.80
### Steps To Reproduce
Install and use Vaultwarden normally (extension or desktop app)
Log in and access the vault
Leave the client running for some time
Observe repeated GET requests to /api/tasks returning 404
Client IP eventually gets banned by server-side protections
### Expected Result
The client should not repeatedly retry after persistent 404 responses, and normal usage should not trigger IP bans.
### Actual Result
The client continuously sends requests to /api/tasks returning 404, triggering rate limiting and an IP ban.
### Logs
```text
[17/Dec/2025:08:39:27 +0100] - 404 404 - GET https domain.tld "/api/tasks" [Client X.X.X.X] [Length 677] [Gzip 2.41] [Sent-to X.X.X.X] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-"
```
### Screenshots or Videos
### Additional Context
_No response_
GiteaMirror
added the bug label 2026-07-13 20:14:32 -05:00
That endpoint was added already in #6557 and is available in the current testing image. If you don't want to use that you should downgrade your clients until there's a new release.
<!-- gh-comment-id:3664929401 -->
@stefan0xC commented on GitHub (Dec 17, 2025):
That endpoint was added already in #6557 and is available in the current `testing` image. If you don't want to use that you should downgrade your clients until there's a new release.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @nathgoat on GitHub (Dec 17, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6565
Prerequisites
Vaultwarden Support String
I am using Vaultwarden and my server eventually bans my client IP due to excessive requests.
This happens:
So it does not appear to be extension-specific.
Observed behavior:
Error seen in server logs:
[17/Dec/2025:08:39:27 +0100] - 404 404 - GET https domain.tld "/api/tasks" [Client X.X.X.X] [Length 677] [Gzip 2.41] [Sent-to X.X.X.X] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" "-"
Scope:
Expected behavior:
Vaultwarden Build Version
2025.12.0
Deployment method
Official Container Image
Custom deployment method
Yes. Vaultwarden is deployed using Docker behind a reverse proxy with rate limiting enabled.
No other custom modifications have been applied to Vaultwarden itself.
Reverse Proxy
.
Host/Server Operating System
Linux
Operating System Version
Debian 12
Clients
Browser Extension
Client Version
Edge 143.0.3650.80
Steps To Reproduce
Install and use Vaultwarden normally (extension or desktop app)
Log in and access the vault
Leave the client running for some time
Observe repeated GET requests to /api/tasks returning 404
Client IP eventually gets banned by server-side protections
Expected Result
The client should not repeatedly retry after persistent 404 responses, and normal usage should not trigger IP bans.
Actual Result
The client continuously sends requests to /api/tasks returning 404, triggering rate limiting and an IP ban.
Logs
Screenshots or Videos
Additional Context
No response
@stefan0xC commented on GitHub (Dec 17, 2025):
That endpoint was added already in #6557 and is available in the current
testingimage. If you don't want to use that you should downgrade your clients until there's a new release.@BlackDex commented on GitHub (Dec 17, 2025):
Closing as resolved via #6557