{"record":{"id":"9682361876254eb3","repo":"bitwarden/server","slug":"cipher-was-not-encrypted-for-the-current-user-ple","errorCode":null,"errorMessage":"Cipher was not encrypted for the current user. Please try again.","messagePattern":"Cipher was not encrypted for the current user\\. Please try again\\.","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Vault/Controllers/CiphersController.cs","lineNumber":174,"sourceCode":"            GetOrganizationAbility(cipher, organizationAbilities),\n            _globalSettings,\n            collectionCiphersGroupDict)).ToArray();\n        return new ListResponseModel<CipherDetailsResponseModel>(responses);\n    }\n\n\n    [HttpPost(\"\")]\n    public async Task<CipherResponseModel> Post([FromBody] CipherRequestModel model)\n    {\n        var user = await _userService.GetUserByPrincipalAsync(User);\n\n        // Validate the model was encrypted for the posting user\n        if (model.EncryptedFor != null)\n        {\n            if (model.EncryptedFor != user.Id)\n            {\n                _logger.LogError(\"Cipher was not encrypted for the current user. CurrentUser: {CurrentUserId}, EncryptedFor: {EncryptedFor}\", user.Id, model.EncryptedFor);\n                throw new BadRequestException(\"Cipher was not encrypted for the current user. Please try again.\");\n            }\n        }\n\n        var cipher = model.ToCipherDetails(user.Id);\n        if (cipher.OrganizationId.HasValue && !await _currentContext.OrganizationUser(cipher.OrganizationId.Value))\n        {\n            throw new NotFoundException();\n        }\n\n        await _cipherService.SaveDetailsAsync(cipher, user.Id, model.LastKnownRevisionDate, null, cipher.OrganizationId.HasValue);\n        var response = new CipherResponseModel(cipher, user, await GetOrganizationAbilityAsync(cipher), _globalSettings);\n        return response;\n    }\n\n    [HttpPost(\"create\")]\n    public async Task<CipherResponseModel> PostCreate([FromBody] CipherCreateRequestModel model)\n    {\n        var user = await _userService.GetUserByPrincipalAsync(User);","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Vault/Controllers/CiphersController.cs#L156-L192","documentation":"POST /ciphers (Post) checks that the request body's `EncryptedFor` matches the authenticated user's id. EncryptedFor records which user's key the cipher was encrypted for; a mismatch means the server cannot decrypt the payload and rejects it as HTTP 400. This guards against stale/multi-account clients encrypting for the wrong user.","triggerScenarios":"POST /ciphers where `model.EncryptedFor` is set to a user id other than the currently authenticated user (e.g. an account switch without re-encryption, or a replayed request under a different account).","commonSituations":"Multi-account clients (web/desktop) where the active account differs from the account whose key was used; a stale session after re-login; replaying a captured request as another user.","solutions":["Ensure the client encrypts the cipher key with the currently-authenticated user's key and sets EncryptedFor to that user's id.","Re-sync or log out and back in to refresh the active user context before retrying.","Verify the active account id before constructing the request payload."],"exampleFix":"// before\nPOST /ciphers  body: { \"encryptedFor\": \"<oldUserGuid>\", ... }\n// after\nPOST /ciphers  body: { \"encryptedFor\": \"<currentActiveUserGuid>\", ... }","handlingStrategy":"validation","validationCode":"function buildCipherPayload(activeUserId, cipher) {\n  if (cipher.encryptedFor != null && cipher.encryptedFor !== activeUserId) {\n    throw new Error('cipher.encryptedFor must match the active user id');\n  }\n  return { ...cipher, encryptedFor: activeUserId };\n}","typeGuard":"function isEncryptedForUser(payload: { encryptedFor?: string | null }, userId: string): boolean {\n  return payload.encryptedFor == null || payload.encryptedFor === userId;\n}","tryCatchPattern":"try { await api.post('/ciphers', payload); }\ncatch (e) {\n  if (e?.response?.status === 400 && /encrypted for the current user/i.test(e.response.data?.message ?? '')) {\n    await resyncActiveAccount(); // refresh user context, then retry once\n  } else throw e;\n}","preventionTips":["Derive EncryptedFor from the active account, never cache it.","In multi-account clients, re-encrypt when the active account changes.","Re-sync or re-login on session staleness before editing."],"tags":["cipher","encryption","vault","validation","multi-account","bad-request"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}