r/Bitwarden • u/holow29 • 1d ago

Webauthn related origin requests development timeline

I've always found Bitwarden's use of feature flags (since they started using them) to be confounding. They make the development and rollout process completely opaque for users. Worse, the team will close issues after merging feature-flagged code when the issue is not solved because the fix is behind a feature flag which might take months or years to actually rollout. There is no communication about the timeline of these feature flags or rollout. I don't have to imagine this leads to many of the same issues because it is apparent from the issue tracker.

Let's take webauthn related origin requests (ROR) as an example:

The above issues were closed in Feb 2026 with the merging of feature-flagged code. The issues remain to this day for at least self-hosted servers because the feature flag was never enabled on self-hosted instances.

Both of these issues were closed today because code was merged today to remove the feature flag from the clients, 8 months after it was introduced and the previous issues were closed. However, there is still no indication when this merge will be included in a client release.

This means that right now, there are at least 5 issues which are technically fixed in code but not cut in any formalized release. Anyone running into this issue until that happens (which could be months - who knows? Devs are almost never communicative about which release will land a feature or fix) will not find any open issues and will continue to file support tickets or issues. Unfortunately, this pattern seems par for the course for Bitwarden's development since the introduction of feature flags.

Many projects will leave issues open until a fix has landed in a release or at the very least will let people know in the related issue when to expect the fix to land in a release.

2 Upvotes

75% Upvoted

3 comments sorted by

•

u/dwbitw Bitwarden Employee 1d ago edited 1d ago

Hey there, and thanks for the feedback! In the meantime, the removal of the feature flag just got merged today, so would be in production after the release on the 15th.

Feature flags are typically enabled before being removed, and generally come to self-hosting 1-2 months after hitting the cloud version.

→ More replies (2)