starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-25 17:25:57 +03:00

[GH-ISSUE #2159] When quickly navigating, All Items (occasionally) treated as Trash #1174

New issue

Closed

opened 2026-03-03 02:06:54 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 02:06:54 +03:00

Owner

Originally created by @ZacharyTalis on GitHub (Dec 20, 2021).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2159

Subject of the issue

Behavior within web vault makes 'trashless' item deletion possible.

Deployment environment

Latest docker image (1.23.1) and web vault (2.25.0).

Steps to reproduce

Log into web vault from new tab.
Quickly click on Trash in the left sidebar.
Sometimes, items not in Trash will display. These items can be deleted permanently without moving into Trash.

Troubleshooting data

Thank heavens for backups, I accidentally deleted 500 items this way 🐙

It's difficult to tell whether this issue is server-side or client-side. Ideally, a web session shouldn't have permissions to permanently delete non-trashed items.

Originally created by @ZacharyTalis on GitHub (Dec 20, 2021). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2159 ### Subject of the issue Behavior within web vault makes 'trashless' item deletion possible. ### Deployment environment Latest docker image (1.23.1) and web vault (2.25.0). ### Steps to reproduce 1. Log into web vault from new tab. 2. Quickly click on `Trash` in the left sidebar. 3. *Sometimes*, items not in Trash will display. These items can be deleted permanently without moving into Trash. ### Troubleshooting data Thank heavens for backups, I accidentally deleted 500 items this way 🐙 It's difficult to tell whether this issue is server-side or client-side. Ideally, a web session shouldn't have permissions to permanently delete non-trashed items. ![The bug reproduced. Both `All Items` and `Trash` are highlighted.](https://user-images.githubusercontent.com/23324896/146844165-0680878d-d3a0-4576-ae20-57b76b91fc7b.png)

kerem

2026-03-03 02:06:54 +03:00

closed this issue
added the
Third party
label

kerem commented

2026-03-03 02:06:55 +03:00

Author

Owner

@BlackDex commented on GitHub (Dec 21, 2021):

I really can't reproduce this at all.
Also, if this sometimes happens, then i think it strangely is a client bug.
The API calls for deleting from the vault and deleting from the trash are different. Also, deleting items from the trash also show the text Permanently, and it also gives an extra warning about it being deleted permanently.

So, I'm a bit hesitant on changing the server regarding this. Also, since the user gets warned about this in strong words.
Though we could maybe add some special check if the it really is in the trash, this just shouldn't happen on the client side at all.

Are you sure you didn't just deleted these items normally first, and then went to the trash and deleted them again?
Also, what happens if you create a new account with lesser items, does this also happens? Or only with this amount of items?

@BlackDex commented on GitHub (Dec 21, 2021): I really can't reproduce this at all. Also, if this sometimes happens, then i think it strangely is a client bug. The API calls for deleting from the vault and deleting from the trash are different. Also, deleting items from the trash also show the text `Permanently`, and it also gives an extra warning about it being deleted permanently. So, I'm a bit hesitant on changing the server regarding this. Also, since the user gets warned about this in strong words. Though we could maybe add some special check if the it really is in the trash, this just shouldn't happen on the client side at all. Are you sure you didn't just deleted these items normally first, and then went to the trash and deleted them again? Also, what happens if you create a new account with lesser items, does this also happens? Or only with this amount of items?

kerem commented

2026-03-03 02:06:55 +03:00

Author

Owner

@ZacharyTalis commented on GitHub (Dec 21, 2021):

I only deleted those items once, yep. The strongly-worded Permanently warning appeared, but I failed to realize the selected items were from outside Trash.

I'm glad those API calls are separate. So yeah, I'd suppose this is a weird client bug...

I'm not able to test with a new account, unfortunately. I can, however, provide you with a video of the bug in action:

https://user-images.githubusercontent.com/23324896/146945567-6d23ec3b-40c1-4f32-bbb8-824a33c3fe6b.mp4

This is also the behavior when Firefox is in Troubleshoot Mode. Firefox Dev Edition v96.0b7 on Linux.

One last note: all my items technically belong to an organization and its collection (SphorbZone in the video, bless our naming scheme).

Feel free to close this issue if you find it unreproducible <3

@ZacharyTalis commented on GitHub (Dec 21, 2021): I only deleted those items once, yep. The strongly-worded `Permanently` warning appeared, but I failed to realize the selected items were from outside Trash. I'm glad those API calls are separate. So yeah, I'd suppose this is a weird client bug... I'm not able to test with a new account, unfortunately. I can, however, provide you with a video of the bug in action: https://user-images.githubusercontent.com/23324896/146945567-6d23ec3b-40c1-4f32-bbb8-824a33c3fe6b.mp4 This is also the behavior when Firefox is in [Troubleshoot Mode](https://support.mozilla.org/en-US/kb/diagnose-firefox-issues-using-troubleshoot-mode). Firefox Dev Edition v96.0b7 on Linux. One last note: all my items technically belong to an organization and its collection (`SphorbZone` in the video, bless our naming scheme). Feel free to close this issue if you find it unreproducible <3

kerem commented

2026-03-03 02:06:55 +03:00

Author

Owner

@BlackDex commented on GitHub (Dec 21, 2021):

Ah.. so it is still loading the items, and then you click on the trash icon before the items are loaded.
Ill do a quick test with a lot of items my self, but i think this is a client-bug.

@BlackDex commented on GitHub (Dec 21, 2021): Ah.. so it is still loading the items, and then you click on the trash icon before the items are loaded. Ill do a quick test with a lot of items my self, but i think this is a client-bug.

kerem commented

2026-03-03 02:06:56 +03:00

Author

Owner

@BlackDex commented on GitHub (Dec 21, 2021):

Ok, i just tested this on both Vaultwarden and a Self-Hosted Bitwarden environment.
It happens on both and the whole senario as described above is the same for both.

What i saw is the following.

Have a huge amount of items which could take a while to load
Login and directly click on the Trash link while the spinner is still active for loading all the vault items.
When deleting an individual item it will be sent to the trash, so nothing wrong there.
When selecting multiple items and using the top-gear to Permanently delete these items, they will be Permanently deleted.

The reason this happens is that the web-vault has changed the interface to the trash environment, and that triggers a different API for multiple selections.

I suggest that you report this issues here: https://github.com/bitwarden/web/issues
That would be the correct location for this bug/issue.

@BlackDex commented on GitHub (Dec 21, 2021): Ok, i just tested this on both Vaultwarden and a Self-Hosted Bitwarden environment. It happens on both and the whole senario as described above is the same for both. What i saw is the following. 1. Have a huge amount of items which could take a while to load 2. Login and directly click on the Trash link while the spinner is still active for loading all the vault items. 3. When deleting an individual item it will be sent to the trash, so nothing wrong there. 4. When selecting multiple items and using the top-gear to `Permanently` delete these items, they will be **Permanently deleted**. The reason this happens is that the web-vault has changed the interface to the trash environment, and that triggers a different API for multiple selections. I suggest that you report this issues here: https://github.com/bitwarden/web/issues That would be the correct location for this bug/issue.