Edit/new login not working in browser extensions

[mostafa-abdelbrr]

Prerequisites

• I have searched the existing Closed AND Open Issues AND Discussions
• I have searched and read the documentation

Vaultwarden Support String

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.35.3
• Web-vault version: v2026.1.1
• OS/Arch: linux/x86_64
• Running within a container: false (Base: Not applicable)
• Database type: PostgreSQL
• Database version: PostgreSQL 15.1 (Ubuntu 15.1-1.pgdg20.04+1) on aarch64-unknown-linux-gnu, compiled by gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0, 64-bit
• Uses config.json: false
• Uses a reverse proxy: true
• IP Header check: true (X-Forwarded-For)
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• Browser/Server Time Check: true
• Server/NTP Time Check: true
• Domain Configuration Check: true
• HTTPS Check: true
• Websocket Check: true
• HTTP Response Checks: false

Config & Details (Generated via diagnostics page)

Show Config & Details

Failed HTTP Checks:

API calls:
Header: 'content-security-policy' does not contain 'default-src 'none''

Config:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 2,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "********://***************************************************************************************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "dns_prefer_ipv6": false,
  "domain": "*****://*************************************",
  "domain_origin": "*****://*************************************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Forwarded-For",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "purge_incomplete_sso_auth": "0 20 0 * * *",
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "",
  "smtp_from_name": "***********",
  "smtp_host": null,
  "smtp_password": null,
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": null,
  "sso_allow_unknown_email_verification": false,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": false,
  "sso_authority": "",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "*****://******************************************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": false,
  "sso_master_password_policy": null,
  "sso_only": false,
  "sso_pkce": true,
  "sso_scopes": "email profile",
  "sso_signups_match_email": true,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

v1.35.3

Deployment method

Official Container Image

Custom deployment method

I deploy to free a Render instance.
This is the public repo that details how to do it:
https://github.com/mostafa-abdelbrr/vaultwarden-render

Reverse Proxy

Render's default

Host/Server Operating System

Linux

Operating System Version

No response

Clients

Browser Extension

Client Version

Firefox 2025.12.1, Brave 2026.1.1

Steps To Reproduce

Create new login item or edit existing one and save.

Expected Result

Successful save/edit operation.

Actual Result

The extension shows an error and completely logs out.

Logs

[2026-02-22 10:06:03.380][response][INFO] (put_cipher) PUT /api/ciphers/<cipher_id> => 401 Unauthorized
[2026-02-22 10:06:03.380][vaultwarden::api::core::ciphers::_][WARN] Request guard `Headers` failed: "No access token provided".
[2026-02-22 10:06:03.380][auth][ERROR] Unauthorized Error: No access token provided
[2026-02-22 10:06:03.380][request][INFO] PUT /api/ciphers/<cipher_id>

Screenshots or Videos

No response

Additional Context

It works normally in the desktop client.
I had an outdated Vaultwarden instance for a while and updated it today just to get this issue. Don't know if skipping versions can cause it.
I installed the browser extension on Brave for the first time today to test and got the same issue.
I tried re-installing in Firefox, same issue.
For the diagnostics, it showed a fail for headers, so I changed the config value from X-Real-IP to X-Forwarded-For hoping it might help, but to no avail. Don't know if it is relevant.

[BlackDex]

Ypur security headers are not correct. Adjust those first, and ensure nothing modifies, add or remove headers set by Vaultwarden.

[BlackDex]

If local works, then something on your hosting system is doing something strange i guess.

On the client side you can start a debugger, in FireFox you need to go to about:debugging#/runtime/this-firefox and then click on inspect at the Bitwarden Extension.

There you can go to the network tab for example, and see what is sent to the server. If that sends the right headers, for example, the same as the web-vault, then it probably is fine on the client side, but then the server doesn't receive the correct headers.

On the server side, you could try to enable some extra logging to see all the received headers, and what the response is.
Set this as ENV LOG_LEVEL=info,rocket::server=trace.

Do not copy/paste these logs without checking for any personal data!

[mostafa-abdelbrr]

I was wrong. It was AdGuard, it was somehow interfering with it.

[BlackDex]

Glad you found it

[mostafa-abdelbrr]

For future reference or other users stumbling upon this, disable this in AdGuard Settings -> Tracking Protection -> "Block third-party Authorization header":

[mostafa-abdelbrr]

Thanks a lot for your help!

[NathanEmb]

For future reference or other users stumbling upon this, disable this in AdGuard Settings -> Tracking Protection -> "Block third-party Authorization header":

Do you know if there is a PiHole version of this?