Vault lock timeout bug with Send from browser extension

I observed that when using the browser extension to create a Send, after it pops out (which is has to in order to create it), if you copy the link and go about doing whatever you want with it, and forgetting to go back and close the new Send browser window, it (the vault and popout browser window) don’t lock per the vault lock timeout setting.

I did this earlier today and went back well over the 15 minute lock setting and there was the Send still on the “Copy link” popout.

It appears to me that the popout ends up as an independent window, not tied (controlled any longer by) the browser extension.

After the 15-minute lock timer should have expired, the vault is still unlocked:

Upon clicking Vault on the bottom toolbar, I’m in my vault:

This is on Brave on Ubuntu. Extension version is 2012.12.4.

@bwuser10000 “It’s not a bug - it’s a feature.” :sweat_smile:

(source: Password Manager Browser Extensions | Bitwarden Help Center)

And I think, that was also the case with the old extension.

Well I know you have to pop it out (to create the Send) but I don’t think that should prevent the vault from locking.

Why do you even have to do that? - I can create Sends without popping the window out:

2025-01-12--23-49-36-vivaldi_602kjUOwwQ

Did you read the sentence in my screenshot that I marked with a red line? It just says so, that popped out windows don’t regard the vault timeout settings… :wink:

1 Like

Didn’t see what you had underlined. I think it would be good for the extension to note that when you do the popout.

As far as why I did the popout, it says you have to in order to create the Send.

If I hit Cancel instead of popping it out, the extension closes as soon as I select a file, and I just go back to this:

Yes, that is indeed not that obvious.

Hm. I can create a file Send without that request to pop out the window. :thinking: And I didn’t find anything to that in the help sites or in the Send FAQs.

As the “warning” request/demand to pop out the window doesn’t look like an error in itself, my best guess would be, that it is related to differences in system (OS?) / configuration. :man_shrugging:

(I’m on Windows 11)

Try Firefox.
TBH It’s a bit of a mess, after the pop out window then you can return to the extension and it’s left mid send.

I mostly use Brave (2024.12.4) and that doesn’t create a pop out window but FF does which is 2024.12.3 today.

The different browsers behave differently, I don’t know which browser bwuser10000 is using.

Ohh…

:face_with_diagonal_mouth:

@bwuser10000 mentioned Brave in the first post.

So, we have now one Brave that does it with, and one that does it without pop out. - What OS do you use @DoctorB ?

And Firefox always with pop out?? (have mine on 2024.11.2 for testing purposes for now)

Ah sorry, I am using Windows 10. I just saw the pop out and I thought I recognised it so tried to be helpful but failed. My bad.

PS I tried Brave on Ubuntu, just now, and it does mandate a pop out just like FF does on Win10. Infact Brave on Ubuntu looks more like FF on Win10 that it does to Brave on Win10.

Oh, no no, that’s no “fail” I think. At least it is obvious now, that it has something to do with the browser (Firefox does require the pop out always?!) and also with the OS (Brave - as an example for Chromium browsers I guess - requires the pop out on Linux, but not on Windows).

Of course, very small “sample size” at the moment.

What I don’t understand at the moment: is it possible, to create successfully a file Send with the pop out at all (or rather in all browsers and OS)? Because if not, that would be a clear bug then.

If it worked also with the pop out, that still would be inconvenient. (to put it mildly)

And it at least would have to be documented in the Help Sites, which circumstances lead to the pop out (and it would be nice to know the reason for it, after all).

I’m fine with the popout mechanism; my only concern is that it opens up a security risk since it prevents normal vault locking (at least time-based). If they could fix it so that the vault locked after the timer expired, regardless of whether there is a popout or not, that would solve the issue.

I can offer you a possible explanation. FF dropdown behaves differently from other browsers’: it closes when the “browser” loses focus. For example, if you use Edge, you can login using the dropdown by dragging username/password from another app. In FF, you cannot do this, as soon as the other app has focus, the dropdown closes.

I think this probably would be true with clicking on the “Browse” button when sending a file, if it was just a dropdown. That may be why there is a hard requirement of having to pop it out first because it requires interactions with another UI element (the generic file selection dialog) that typically would close the dropdown.

Also, I can confirm (with not-latest extension) that working with sidebar in FF works as well.

1 Like

Not disagreeing with you. This may have been filed as a feature request multiple times with no progress, including:

This problem is also true with FF’s “sidebar” feature. No automatic lock if it’s open.

One of the workarounds is, lock your computer when you walk away.