mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-25 17:25:57 +03:00
[GH-ISSUE #2295] Login session expired with account switching #1218
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#1218
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cksapp on GitHub (Feb 11, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2295
Low priority issue, noticed a slight issue with the newest release of the Bitwarden Desktop app 1.31.0
When trying to use the new Account Switching feature, you are able to login to one account with Vaultwarden as normal.
After login to another account with the same VW server, the first initial account logged in will time out.
Latest release of the desktop app reinstalled, and Vaultwarden server upgraded to latest 1.24.0
@BlackDex commented on GitHub (Feb 11, 2022):
Confirmed. It looks like it is trying to access the token,
[INFO] (login) POST /identity/connect/token, but not allowed.@cksapp commented on GitHub (Feb 11, 2022):
Thanks for the info, pretty interesting to know.
I will note it seems this is even less of a priority issue as upstream had several major issues with this release and have rolled back to 1.30 as latest. Who's to say what changes may be made, my guess not much would be changed but best not to even worry about it until this is fully patched and a new public release is available.
@BlackDex commented on GitHub (Feb 24, 2022):
I digged a little bit into this. And it looks like we currently only have a uniqueness on the device-id.
This in turn makes it that we overwrite this when a new user logs-in, which effectively deletes there refresh token.
To change this we need to change the whole code regarding the device table to match on both device-id and user-id on all fronts.
This will take some time and needs some good testing. But it is one the list now :).
Thanks for the report.
@BlackDex commented on GitHub (Mar 3, 2022):
Small update, i think i have a working patch. I just need some time to do some final checking :)