github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-08-26 11:55:50 -05:00
Code Issues 534 Packages Projects Releases 86 Wiki Activity

Session locked at page refresh #5494

New Issue
Closed
opened 2026-03-07 20:27:37 -06:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-07 20:27:37 -06:00
Owner
Copy Link
Copy Source

Originally created by @azertylr on GitHub (Feb 14, 2024).

Subject of the issue

Vault is locked immedialy after page refresh

Deployment environment

  • vaultwarden version: 1.30.3

  • Install method: Docker

  vaultwarden2:
    container_name: vaultwarden2
    image: vaultwarden/server:latest
    networks:
      - net
    environment:
      - DOMAIN=https://XXX
      - LOG_LEVEL=DEBUG
    volumes:
      - vw-vol:/data

  • Clients used: web vault with Firefox 122.0.1 or Edge 121.0.2277.112

  • Reverse proxy and version: nginx 1.24.0 with Nginx - v1.29.0+ (by @BlackDex) config

Steps to reproduce

create a fresh vaultwarden install
create an user account
login
refresh the page

Expected behaviour

the session got locked after the time parameter (15 min by default)

Actual behaviour

the session got immedialy locked

Troubleshooting data

no error on Firefox network monitor

[2024-02-14 08:13:33.634][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK
[2024-02-14 08:13:33.678][request][INFO] POST /identity/connect/token
[2024-02-14 08:13:33.771][vaultwarden::api::identity][INFO] User  logged in successfully. IP:
[2024-02-14 08:13:33.771][response][INFO] (login) POST /identity/connect/token => 200 OK
[2024-02-14 08:13:33.844][request][INFO] GET /api/config
[2024-02-14 08:13:33.844][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:13:33.935][request][INFO] POST /identity/connect/token
[2024-02-14 08:13:33.944][response][INFO] (login) POST /identity/connect/token => 200 OK
[2024-02-14 08:13:34.015][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL
[2024-02-14 08:13:34.015][vaultwarden::api::notifications][INFO] Accepting Rocket WS connection from 
[2024-02-14 08:13:34.016][response][INFO] (websockets_hub) GET /notifications/hub?<data..> => 200 OK
[2024-02-14 08:13:34.201][request][INFO] GET /api/sync?excludeDomains=true
[2024-02-14 08:13:34.205][response][INFO] (sync) GET /api/sync?<data..> => 200 OK
[2024-02-14 08:13:34.274][request][INFO] GET /api/config
[2024-02-14 08:13:34.275][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:13:36.166][tungstenite::protocol][DEBUG] Received close frame: Some(CloseFrame { code: Away, reason: "" })
[2024-02-14 08:13:36.166][tungstenite::protocol][DEBUG] Replying to close with Frame { header: FrameHeader { is_final: true, rsv1: false, rsv2: false, rsv3: false, opcode: Control(Close), mask: None }, payload: [3, 233] }
[2024-02-14 08:13:36.166][vaultwarden::api::notifications][INFO] Closing WS connection from 
[2024-02-14 08:13:36.213][request][INFO] GET /
[2024-02-14 08:13:36.213][response][INFO] (web_index) GET / => 200 OK
[2024-02-14 08:13:36.624][request][INFO] GET /api/config
[2024-02-14 08:13:36.624][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:13:55.168][request][INFO] GET /api/config
[2024-02-14 08:13:55.168][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:13:56.478][request][INFO] GET /api/devices/knowndevice
[2024-02-14 08:13:56.479][response][INFO] (get_known_device) GET /api/devices/knowndevice => 200 OK
[2024-02-14 08:13:57.627][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:13:57.627][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:13:57.703][request][INFO] GET /alive
[2024-02-14 08:13:57.704][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:14:04.314][request][INFO] POST /identity/accounts/prelogin
[2024-02-14 08:14:04.315][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK
[2024-02-14 08:14:04.360][request][INFO] POST /identity/connect/token
[2024-02-14 08:14:04.455][vaultwarden::api::identity][INFO] User  logged in successfully. IP: 
[2024-02-14 08:14:04.455][response][INFO] (login) POST /identity/connect/token => 200 OK
[2024-02-14 08:14:04.500][request][INFO] GET /api/config
[2024-02-14 08:14:04.500][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:14:04.578][request][INFO] POST /identity/connect/token
[2024-02-14 08:14:04.584][response][INFO] (login) POST /identity/connect/token => 200 OK
[2024-02-14 08:14:04.626][request][INFO] GET /api/sync?excludeDomains=true
[2024-02-14 08:14:04.629][response][INFO] (sync) GET /api/sync?<data..> => 200 OK
[2024-02-14 08:14:04.669][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL
[2024-02-14 08:14:04.669][vaultwarden::api::notifications][INFO] Accepting Rocket WS connection from
[2024-02-14 08:14:04.670][response][INFO] (websockets_hub) GET /notifications/hub?<data..> => 200 OK
[2024-02-14 08:14:04.689][request][INFO] GET /api/config
[2024-02-14 08:14:04.689][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:14:08.574][tungstenite::protocol][DEBUG] Received close frame: Some(CloseFrame { code: Away, reason: "" })
[2024-02-14 08:14:08.574][tungstenite::protocol][DEBUG] Replying to close with Frame { header: FrameHeader { is_final: true, rsv1: false, rsv2: false, rsv3: false, opcode: Control(Close), mask: None }, payload: [3, 233] }
[2024-02-14 08:14:08.574][vaultwarden::api::notifications][INFO] Closing WS connection from 
[2024-02-14 08:14:08.614][request][INFO] GET /
[2024-02-14 08:14:08.615][response][INFO] (web_index) GET / => 200 OK
[2024-02-14 08:14:09.091][request][INFO] GET /api/config
[2024-02-14 08:14:09.091][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:14:57.630][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:14:57.630][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:14:57.765][request][INFO] GET /alive
[2024-02-14 08:14:57.766][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:15:57.631][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:15:57.631][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:15:57.822][request][INFO] GET /alive
[2024-02-14 08:15:57.823][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:16:57.634][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:16:57.634][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:16:57.879][request][INFO] GET /alive
[2024-02-14 08:16:57.879][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:17:57.636][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:17:57.636][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:17:57.946][request][INFO] GET /alive
[2024-02-14 08:17:57.946][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:18:57.640][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:18:57.640][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:18:58.026][request][INFO] GET /alive
[2024-02-14 08:18:58.029][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:19:57.641][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:19:57.642][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:19:58.084][request][INFO] GET /alive
[2024-02-14 08:19:58.085][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:20:57.644][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:20:57.644][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:20:58.136][request][INFO] GET /alive
[2024-02-14 08:20:58.137][response][INFO] (alive) GET /alive => 200 OK
[2024-02-14 08:21:22.408][request][INFO] POST /identity/connect/token
[2024-02-14 08:21:22.414][response][INFO] (login) POST /identity/connect/token => 200 OK
[2024-02-14 08:21:22.452][request][INFO] GET /api/sync?excludeDomains=true
[2024-02-14 08:21:22.454][response][INFO] (sync) GET /api/sync?<data..> => 200 OK
[2024-02-14 08:21:22.485][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL
[2024-02-14 08:21:22.485][vaultwarden::api::notifications][INFO] Accepting Rocket WS connection from 
[2024-02-14 08:21:22.485][response][INFO] (websockets_hub) GET /notifications/hub?<data..> => 200 OK
[2024-02-14 08:21:22.519][request][INFO] GET /api/config
[2024-02-14 08:21:22.519][response][INFO] (config) GET /api/config => 200 OK
[2024-02-14 08:21:25.528][request][INFO] GET /api/two-factor
[2024-02-14 08:21:25.530][response][INFO] (get_twofactor) GET /api/two-factor => 200 OK
[2024-02-14 08:21:25.539][request][INFO] GET /api/accounts/profile
[2024-02-14 08:21:25.540][response][INFO] (profile) GET /api/accounts/profile => 200 OK
[2024-02-14 08:21:26.399][request][INFO] GET /api/accounts/profile
[2024-02-14 08:21:26.400][response][INFO] (profile) GET /api/accounts/profile => 200 OK
[2024-02-14 08:21:57.645][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
[2024-02-14 08:21:57.645][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
[2024-02-14 08:21:58.203][request][INFO] GET /alive
[2024-02-14 08:21:58.203][response][INFO] (alive) GET /alive => 200 OK
Originally created by @azertylr on GitHub (Feb 14, 2024). ### Subject of the issue Vault is locked immedialy after page refresh ### Deployment environment * vaultwarden version: 1.30.3 * Install method: Docker ``` vaultwarden2: container_name: vaultwarden2 image: vaultwarden/server:latest networks: - net environment: - DOMAIN=https://XXX - LOG_LEVEL=DEBUG volumes: - vw-vol:/data ``` * Clients used: web vault with Firefox 122.0.1 or Edge 121.0.2277.112 * Reverse proxy and version: nginx 1.24.0 with Nginx - v1.29.0+ (by [@BlackDex](https://github.com/BlackDex)) config ### Steps to reproduce create a fresh vaultwarden install create an user account login refresh the page ### Expected behaviour the session got locked after the time parameter (15 min by default) ### Actual behaviour the session got immedialy locked ### Troubleshooting data no error on Firefox network monitor ``` [2024-02-14 08:13:33.634][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK [2024-02-14 08:13:33.678][request][INFO] POST /identity/connect/token [2024-02-14 08:13:33.771][vaultwarden::api::identity][INFO] User logged in successfully. IP: [2024-02-14 08:13:33.771][response][INFO] (login) POST /identity/connect/token => 200 OK [2024-02-14 08:13:33.844][request][INFO] GET /api/config [2024-02-14 08:13:33.844][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:13:33.935][request][INFO] POST /identity/connect/token [2024-02-14 08:13:33.944][response][INFO] (login) POST /identity/connect/token => 200 OK [2024-02-14 08:13:34.015][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL [2024-02-14 08:13:34.015][vaultwarden::api::notifications][INFO] Accepting Rocket WS connection from [2024-02-14 08:13:34.016][response][INFO] (websockets_hub) GET /notifications/hub?<data..> => 200 OK [2024-02-14 08:13:34.201][request][INFO] GET /api/sync?excludeDomains=true [2024-02-14 08:13:34.205][response][INFO] (sync) GET /api/sync?<data..> => 200 OK [2024-02-14 08:13:34.274][request][INFO] GET /api/config [2024-02-14 08:13:34.275][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:13:36.166][tungstenite::protocol][DEBUG] Received close frame: Some(CloseFrame { code: Away, reason: "" }) [2024-02-14 08:13:36.166][tungstenite::protocol][DEBUG] Replying to close with Frame { header: FrameHeader { is_final: true, rsv1: false, rsv2: false, rsv3: false, opcode: Control(Close), mask: None }, payload: [3, 233] } [2024-02-14 08:13:36.166][vaultwarden::api::notifications][INFO] Closing WS connection from [2024-02-14 08:13:36.213][request][INFO] GET / [2024-02-14 08:13:36.213][response][INFO] (web_index) GET / => 200 OK [2024-02-14 08:13:36.624][request][INFO] GET /api/config [2024-02-14 08:13:36.624][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:13:55.168][request][INFO] GET /api/config [2024-02-14 08:13:55.168][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:13:56.478][request][INFO] GET /api/devices/knowndevice [2024-02-14 08:13:56.479][response][INFO] (get_known_device) GET /api/devices/knowndevice => 200 OK [2024-02-14 08:13:57.627][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:13:57.627][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:13:57.703][request][INFO] GET /alive [2024-02-14 08:13:57.704][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:14:04.314][request][INFO] POST /identity/accounts/prelogin [2024-02-14 08:14:04.315][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK [2024-02-14 08:14:04.360][request][INFO] POST /identity/connect/token [2024-02-14 08:14:04.455][vaultwarden::api::identity][INFO] User logged in successfully. IP: [2024-02-14 08:14:04.455][response][INFO] (login) POST /identity/connect/token => 200 OK [2024-02-14 08:14:04.500][request][INFO] GET /api/config [2024-02-14 08:14:04.500][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:14:04.578][request][INFO] POST /identity/connect/token [2024-02-14 08:14:04.584][response][INFO] (login) POST /identity/connect/token => 200 OK [2024-02-14 08:14:04.626][request][INFO] GET /api/sync?excludeDomains=true [2024-02-14 08:14:04.629][response][INFO] (sync) GET /api/sync?<data..> => 200 OK [2024-02-14 08:14:04.669][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL [2024-02-14 08:14:04.669][vaultwarden::api::notifications][INFO] Accepting Rocket WS connection from [2024-02-14 08:14:04.670][response][INFO] (websockets_hub) GET /notifications/hub?<data..> => 200 OK [2024-02-14 08:14:04.689][request][INFO] GET /api/config [2024-02-14 08:14:04.689][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:14:08.574][tungstenite::protocol][DEBUG] Received close frame: Some(CloseFrame { code: Away, reason: "" }) [2024-02-14 08:14:08.574][tungstenite::protocol][DEBUG] Replying to close with Frame { header: FrameHeader { is_final: true, rsv1: false, rsv2: false, rsv3: false, opcode: Control(Close), mask: None }, payload: [3, 233] } [2024-02-14 08:14:08.574][vaultwarden::api::notifications][INFO] Closing WS connection from [2024-02-14 08:14:08.614][request][INFO] GET / [2024-02-14 08:14:08.615][response][INFO] (web_index) GET / => 200 OK [2024-02-14 08:14:09.091][request][INFO] GET /api/config [2024-02-14 08:14:09.091][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:14:57.630][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:14:57.630][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:14:57.765][request][INFO] GET /alive [2024-02-14 08:14:57.766][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:15:57.631][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:15:57.631][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:15:57.822][request][INFO] GET /alive [2024-02-14 08:15:57.823][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:16:57.634][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:16:57.634][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:16:57.879][request][INFO] GET /alive [2024-02-14 08:16:57.879][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:17:57.636][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:17:57.636][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:17:57.946][request][INFO] GET /alive [2024-02-14 08:17:57.946][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:18:57.640][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:18:57.640][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:18:58.026][request][INFO] GET /alive [2024-02-14 08:18:58.029][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:19:57.641][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:19:57.642][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:19:58.084][request][INFO] GET /alive [2024-02-14 08:19:58.085][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:20:57.644][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:20:57.644][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:20:58.136][request][INFO] GET /alive [2024-02-14 08:20:58.137][response][INFO] (alive) GET /alive => 200 OK [2024-02-14 08:21:22.408][request][INFO] POST /identity/connect/token [2024-02-14 08:21:22.414][response][INFO] (login) POST /identity/connect/token => 200 OK [2024-02-14 08:21:22.452][request][INFO] GET /api/sync?excludeDomains=true [2024-02-14 08:21:22.454][response][INFO] (sync) GET /api/sync?<data..> => 200 OK [2024-02-14 08:21:22.485][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL [2024-02-14 08:21:22.485][vaultwarden::api::notifications][INFO] Accepting Rocket WS connection from [2024-02-14 08:21:22.485][response][INFO] (websockets_hub) GET /notifications/hub?<data..> => 200 OK [2024-02-14 08:21:22.519][request][INFO] GET /api/config [2024-02-14 08:21:22.519][response][INFO] (config) GET /api/config => 200 OK [2024-02-14 08:21:25.528][request][INFO] GET /api/two-factor [2024-02-14 08:21:25.530][response][INFO] (get_twofactor) GET /api/two-factor => 200 OK [2024-02-14 08:21:25.539][request][INFO] GET /api/accounts/profile [2024-02-14 08:21:25.540][response][INFO] (profile) GET /api/accounts/profile => 200 OK [2024-02-14 08:21:26.399][request][INFO] GET /api/accounts/profile [2024-02-14 08:21:26.400][response][INFO] (profile) GET /api/accounts/profile => 200 OK [2024-02-14 08:21:57.645][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2024-02-14 08:21:57.645][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2024-02-14 08:21:58.203][request][INFO] GET /alive [2024-02-14 08:21:58.203][response][INFO] (alive) GET /alive => 200 OK ```
GiteaMirror commented 2026-03-07 20:27:38 -06:00
Author
Owner
Copy Link
Copy Source

@stefan0xC commented on GitHub (Feb 14, 2024):

This is expected behavior: https://bitwarden.com/help/vault-timeout/

@stefan0xC commented on GitHub (Feb 14, 2024): This is expected behavior: https://bitwarden.com/help/vault-timeout/
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#5494