-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Description
Steps To Reproduce
- In the browser extension, set default URI match detection to "Exact".
- In the browser, open a website that contains a login form.
- In the extension, search for a login item that does not already contain a matching URI (and for which any existing URI fields have the corresponding match detection option set to "Default").
- Click the "Options" menu (three vertical dots), and select Autofill.
- In the browser extension, set default URI match detection to "Base domain".
- Edit the login item from Step 3, clicking the ⚙️ icon for each saved "Website (URI)" field and changing the match detection to "Exact".
- Click Save, and then click < (Back) to return to the search results.
- For the modified login item (from Step 6), click the "Options" menu (three vertical dots), and select Autofill.
Expected Result
In Step 4 and in Step 8, expect to be presented with the "Confirm Autofill" modal pop-up, with options to click Autofill and add this website (saving the current browser URL as a new URI in the login item) or Autofill without adding (forcing the autofill on an non-matching website).
Actual Result
There are no options to "Autofill and add this website" or to "Autofill without adding". Instead, there is an error message that says "Cannot autofill: Default matching is set to 'Exact Match'. The current website does not exactly match the saved login details for this item."
Screenshots or Videos
Additional Context
There is no good reason why selecting the forced autofill option from the Options menu should in any way be affected by URI match detection settings.
When this feature was being developed (see PR #17142), I had a brief discussion with @jaasen-livefront to explain this (and at that time, I was under the impression that my concerns had been understood).
The forced autofill options (previously called "Autofill" and "Autofill and Save" or "Fill and Save") were never intended to be equivalent to the autofill functions that are available for the set of autofill suggestions (which is generated by applying the URI match detection rules), which can be readily autofilled using multiple existing methods (inline autofill menus; Fill button in Vault view; keyboard shortcuts; context menu; automatic autofill on page load). In contrast, the special options "Autofill" and "Autofill and Save" (originally available at the bottom of the View Login view, then subsequently relegated to the Options menu and renamed first "Autofill" and "Fill and Save", then "Autofill without adding" and "Autofill and add this website", respectively) were always supposed to be options for forced autofill, specifically designed for situations in which the active URI does not have an existing match in the vault.
This is explained in the original PR by @eliykat, as well as the original Feature Request topic that lead to the creation of this functionality. A comment by @danielleflinn from June 2024 affirmed that the browser extension UI refresh was not going to break the existing functionality: "If the item you want to fill, does not appear in the suggested section (based on its URI matching), you will still be able to access the auto-fill action from the 3 dot “more” menu."
I cannot conceive of any reasonable rationale for honoring the URI match detection settings when a user is deliberately intending to perform a forced autofill of a login item that has no valid match to the current website. This bug creates a seriously degraded user experience, capriciously denying us the option to save new URI strings to existing login items, and defeating the whole purpose of the forced "Autofill" and "Autofill and Save" options.
Operating System
Windows
Operating System Version
Windows 11 (24H2)
Web Browser
Chrome
Browser Version
No response
Environment Versions
Version: 2025.12.0; SDK: 'main (0107af7)'; Server version: 2025.12.1.
Issue Tracking Info
- I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.