One of the most convenient features of Bitwarden is its auto-fill functionality, which allows users to quickly log in to their favorite websites without having to remember their login credentials. However, there are situations where this feature can be a bit confusing. In this article, we'll explore one such scenario and clarify how Bitwarden handles it.

The issue arises when the URL of the webpage does not match the URL of the iframe, but the iframe URL matches a different login item in the vault. For example, imagine you have separate login items for the Apple Store (app.stores.apple.com) and your iCloud account (icloud.com). If you auto-fill on a page that contains an iframe delivered by apple.com (e.g., support.apple.com), will Bitwarden pull the auto-fill credentials for one or the other?

Before we dive into the answer, it's essential to understand how Bitwarden handles iframes. Contrary to what some may think, Bitwarden does not use iframes to do URI matches. Instead, it relies on the URL in the browser. This means that when you auto-fill a login form contained within an iframe, Bitwarden checks the URL of the page against your specified URI match detection method and global equivalent domains (in your Domain Rules).

The recent hotfix for Bitwarden introduces some changes to this behavior. After applying the patch, Bitwarden will use the URL of the iframe source to perform the URI match check. This means that if there is a login form contained within an iframe on the page being auto-filled, and the URL of the iframe source is deemed 'trusted', then that login form will only be auto-filled automatically.

In summary, when dealing with iframes and Bitwarden auto-fill, it's crucial to understand that Bitwarden does not use iframes for URI matches. Instead, it relies on the URL in the browser, which means that the URL of the page being auto-filled is checked against your specified URI match detection method and global equivalent domains. The recent hotfix changes this behavior slightly, but only when a trusted iframe source is involved. By understanding these nuances, you can make the most out of Bitwarden's auto-fill feature and enjoy a more seamless login experience.

Bitwarden auto fill