htaccess autofill and pattern matching used to work

[plittlefield]

Steps To Reproduce

Try to load a web page protected by Basic Authentication htaccess that has a unique URI.

Expected Result

A basic authentication htaccess protected page used to be automatically filled in and submitted by Bitwarden leading to the page automatically displaying.

Actual Result

It now no longer works automatically.

Screenshots or Videos

No response

Additional Context

A subreddit …

https://www.reddit.com/r/Bitwarden/comments/1gaxw8o/htaccess_autofill_and_pattern_matching_used_to/

Operating System

Linux

Operating System Version

No response

Web Browser

Chrome, Firefox

Browser Version

No response

Build Version

2024.10.1

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for reporting this issue! We've added this to our internal tracking system.
ID: PM-14055

[crimle]

I have the same issue.

If I have only 1 vault entry for this website (with the htaccess-credentials), the following workaround works for me:
As soon as the prompt for the htaccess-credentials appears, press [Esc] then [F5] in order to reload the page. This obviously causes Bitwarden to enter the credentials invisibly and I am done with step 1. The Back-End login page of the website appears.

Obviously, I need a second vault entry with the Back-End credentials. As soon as there are two vault entries for this URL, the workaround mentionned above stops working. Pressing [Esc] then [F5] results in an endless repeat of the htaccess-credentials.

Operating System
Windows 11 23H2

Web Browser
Firefox 131.0.3

Bitwarden Version
2024.10.1

[plittlefield]

I have only 1 'exact' entry in Bitwarden for this web site but like you have about 30 entries for subdomains off the same domain name.

I get offered 30 different passwords because of the default pattern matching - but that's not relevant (or maybe it is!) to this particular issue.

Bitwarden in Firefox or Chrome used to 'automagically' fill in the credentials for any bookmarks I had for sites using BasicAuth htaccess pop-up protection from Apache or NginX.

I don't know when it stopped working because I don't visit those protected pages often.

Hopefully, we can work together to fix it.

Like I said, I am happy to spin up a Docker on a test domain to debug this.

[SergeantConfused]

Hello everyone,

Just to make sure that you and I are on the same page, when you visit the URL in question, does Bitwarden show only one (1) matching vault item? I'm asking because if the extension has more than one (1) matching vault item, it would not perform autofill into Basic Auth prompts.

*Edit: I tested this in Firefox 131.0.3 with Bitwarden extension 2024.10.1, and the extension was able to autofill a basic auth prompt silently, and proceed to the webpage behind the authentication request automatically.

Thank you in advance,

[crimle]

I have 1 vault entry for this website and Bitwarden shows (1) matching vault item. In this case, the following workaround works for me:

• press [Esc] then [F5] in order to reload the page.
• this obviously causes Bitwarden to enter the credentials invisibly and the Back-End login page of the website appears.

So far, this is not the perfect solution, but as I said, a workaround, which I could cope with. But then, the main big issue is: the htaccess-password-prompt leads to a site with the very same URL where I need to login with a username and a complicated password. I therefore need to be able to save these credentials and enter them with a click of the mouse too. But here I am stuck:
as soon as there are 2 vault entries for this URL, the workaround mentionned above stops working. Pressing [Esc] then [F5] results in an endless repeat of the htaccess-credentials.

[plittlefield]

OK, so my situation is slightly different but that still doesn't change the fact it USED to work - at least I swear it used to work :-/

Yes, there more than (9) matching vault items, because I've got a server that runs staging web sites using subdomains off the main domain name.

So, for all those staging sites, Bitwarden is using the 'default matching pattern' in its' database.

Can I make this work by editing all those entries and changing the matching pattern to 'Exact' perhaps?

Would that then make the .htaccess protected page work because it's also got an 'Exact' pattern match and thereby only has 1 matching vault item?

Thanks.

[crimle]

I am happy to announce, that I have kind of a solution that is acceptable for me.

Preparation

My first decision: begin from the scratch. So I deleted both items from my Bitwarden vault (the Back-End and the htaccess credentials.

Then I manually added the «htaccess» item using the [+] symbol on top. My settings here:
Name: «mywebsite.ch htaccess»
Username: the htaccess username
Password: the htaccess password
URI 1: the complete URL of by Back-End login page https://mywebsite.ch/backend
Option: Basic domain

Then I manually added the «Back-End» item using the [+] symbol on top. My settings here:
Name: «mywebsite.ch Back-End»
Username: the Back-End username
Password: the Back-End password
URI 1: the complete URL of by Back-End login page https://mywebsite.ch/backend (the same as for the first item)
Option: Default match detection

Finally I would like to mention, that in Bitwarden's general settings, the option «Auto-fill when loading the page» is disabled. The reason for this: when I had this option enabled, I experienced a number of unwanted side effects as Bitwarden pasted my credentials into fields at every possible and impossible opportunity. For example, when I added a new user in the back-end, this new user suddenly had my username and password and this data was sent to the user by email. OMG!

Usage

The usage now is somewhat simple:

• Open the relevant URL
• as soon as I am prompted for the htaccess username and password, I press [Esc] then [F5] in order to refresh the page
• Now the Back-End login fields appear
• Bitwarden suggests two login items and I just need to select the item with the Back-End credentials

[plittlefield]

Alas, no - the ESC and refresh trick does not work for me... but then I have 55 logins based on the domain name.

So, I think what I will have to do is to use one of my spare domain names and create a simple docker nginx to test this, so that there are NO OTHER logins in the Bitwarden Vault for this spare domain name.

I shall return ...