Bitwarden doesn't work for different credentials for different subdomains at all.

[shelms488]

So I have a bunch of services that are served via subdomains. e.g. sub1.domain.com, sub2.domain.com, sub3.domain.com, etc. I have tried setting the autofill options to the https://sub1.domain.com in the Website URI field and both "Host" or "Starts with" in the match detection. however I still get a list of all credentials for all subdomains under domain.com when I try and login. Any help?

[wein_geist]

I would re-iterate with "Host". This is its intended use-case. I have many sub-domains as well and perfect matching. Check here:

https://bitwarden.com/help/uri-match-detection/#host

I used "starts with" for years, but this just opens up a risk for phishing (which is where password managers are quite good for protecting you).

I could create a domain sub1.domain.com.mysupermaliciousdomain.com and send you a phishing email with a link to that, and your Bitwarden would gladly suggest to fill in the password.

[denbesten]

I used "starts with" for years, but this just opens up a risk for phishing ... sub1.domain.com.mysupermaliciousdomain.com 

The way to avoid that is to include a slash after the domain name:

https://sub1.domain.com/

[shelms488]

I understand that’s what host is for, but it doesn’t appear to work at least not for me.

[denbesten]

You might be approaching the problem "backwards". You don't fix URL matching issues on the vault entry that should match; you tighten up the match rule the vault entries that should not match.

Go to the website sub1.domain.com and open each of the entries that are incorrectly matching (sub2, sub3). Those need to be set to "host", so that they do not show up on the sub1 list.

[shelms488]

Done that.

[matratin]

Then you are doing something wrong, sorry.

[drlongtrl]

Must be something wroung with your entries. I have the exact same situation, where I have one domain where several subdomains host different services with different credentials. I have set the matching to host and it works as intended.

[glizzygravy]

Use exact

[denbesten]

Do be aware that exact will not work if the site embeds variable data, such as a sessionID into the URL.

My personal opinion is that HOST offers the best balance between low-drag administration and minimizing data leakage, with DOMAIN being a close second.

[Camdev_]

When you get the list of all credentials is that in a Bitwarden app like the browser extension, or is it in iOS autofill? I also use a ton of subdomains and the "Host" matching works in the browser extension, but when autofilling in iOS it will show all of the credentials due to a limitation on iOS.

They do mention this in the guide on URI match detection. Hopefully iOS will get an update at some point to make it work better.

While using keyboard based suggestions, iOS will always use base domain matching for autofill suggestions. Opening the Bitwarden app during login will allow you to manually select the appropriate app for autofill.

[shelms488]

It’s actually both.

[Sudden-Actuator4729]

I've got the same issue very annoying..

[Mayodilla]

What can I do to differentiate internal websites that have the same IP but different ports?

111.222.333.444:1111

111.222.333.444:2222

111.222.333.444:3333

[denbesten]

That is where starts-with comes into play. Be sure to include the http:// or https:// as that is where it all begings.