Try old refresh token if we fail to decode jwt #200

New Issue

MrUnknownDE · 2026-04-05T20:37:35+02:00

MrUnknownDE commented

2026-04-05 20:37:35 +02:00

Originally created by @dani-garcia on 12/29/2025

The mobile apps don't seem to handle an error during the usage of refresh_token very well, so this code adds a backwards compatibility path to process the access token the old school way when it fails to decode as a JWT.

To test that this worked, what I've done is:

Setup an instance of 1.34.3, log in to a web vault, lock it but don't close it.
With dev tools open (and with preserve log enabled) try to unlock, which will make a successful /connect/token call with the refresh token
Update to 1.35.0
With dev tools open (and with preserve log enabled) try to unlock, this will return a 401, which will redirect you back to the login screen

With this patch, the connect call will succeed and return a new JWT refresh token.

Should fix https://github.com/dani-garcia/vaultwarden/issues/6610

*Originally created by @dani-garcia on 12/29/2025* The mobile apps don't seem to handle an error during the usage of `refresh_token` very well, so this code adds a backwards compatibility path to process the access token the old school way when it fails to decode as a JWT. To test that this worked, what I've done is: - Setup an instance of 1.34.3, log in to a web vault, lock it but don't close it. - With dev tools open (and with `preserve log` enabled) try to unlock, which will make a successful /connect/token call with the refresh token - Update to 1.35.0 - With dev tools open (and with `preserve log` enabled) try to unlock, this will return a 401, which will redirect you back to the login screen With this patch, the connect call will succeed and return a new JWT refresh token. Should fix https://github.com/dani-garcia/vaultwarden/issues/6610

MrUnknownDE closed this issue

2026-04-05 20:37:35 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#200