After logging in on a single-page application (SPA), the login form's input fields remain in the HTML DOM but are hidden via CSS/JS. When the user switches to another tab and switches back, the extension re-fetches credentials from KeePass unnecessarily — even though the user is already authenticated.
Steps to Reproduce
- Open a web application that uses a SPA login flow (e.g. the login form is shown/hidden dynamically without a full page reload).
- Have KeePass running with chromeIPass connected and
autoRetrieveCredentials enabled.
- Log in to the application. The login form fields become hidden but remain in the DOM.
- Switch to any other browser tab.
- Switch back to the logged-in tab.
- Observe in the KeePass notifications / network traffic: a
retrieve_credentials request is made even though the user is already logged in and no login form is visible.
- Repeat steps 4–6 — the request fires every time.
Expected Behavior
After logging in, switching back to the tab should not trigger a credential retrieval. If the login form is no longer visible, the extension should recognise there is nothing to fill and remain idle.
Actual Behavior
retrieve_credentials is sent to KeePass on every tab focus, regardless of login state.
Fix
Reset _called.initCredentialFields, cip.url, cip.submitUrl, and cipFields.combinations inside cipEvents.clearCredentials(). This forces cip.init() in triggerActivatedTab to re-scan the DOM. If the login form is now hidden, no visible credential fields are found, cip.url is never set, and the spurious retrieve_credentials call is skipped.
After logging in on a single-page application (SPA), the login form's input fields remain in the HTML DOM but are hidden via CSS/JS. When the user switches to another tab and switches back, the extension re-fetches credentials from KeePass unnecessarily — even though the user is already authenticated.
Steps to Reproduce
autoRetrieveCredentialsenabled.retrieve_credentialsrequest is made even though the user is already logged in and no login form is visible.Expected Behavior
After logging in, switching back to the tab should not trigger a credential retrieval. If the login form is no longer visible, the extension should recognise there is nothing to fill and remain idle.
Actual Behavior
retrieve_credentialsis sent to KeePass on every tab focus, regardless of login state.Fix
Reset
_called.initCredentialFields,cip.url,cip.submitUrl, andcipFields.combinationsinsidecipEvents.clearCredentials(). This forcescip.init()intriggerActivatedTabto re-scan the DOM. If the login form is now hidden, no visible credential fields are found,cip.urlis never set, and the spuriousretrieve_credentialscall is skipped.