UWP Windows App: "Failed to load/update resources" when handling large datasets (6,000+ secrets)

Installation Issues
1

Checklist:

  • [x] I have read the tutorials, help and searched for similar issues.

  • [x] I provide relevant information about my server (component names and versions, etc.).

  • [x] I provide a copy of my logs and healthcheck.

  • [x] I describe the steps I have taken to troubleshoot the problem.

  • [x] I describe the steps on how to reproduce the issue.

Description: We are experiencing a persistent issue with the Passbolt UWP application for Windows. While the folder hierarchy loads quickly upon login, the secrets themselves never finish loading. After a few seconds, the app displays the following error: "Unable to load/update resources" .

This issue affects all users and all workstations, regardless of the individual hardware.

Technical Context:

  • Passbolt Server Version: 5.13 (Native install on Ubuntu 24.04).

  • Client App: Latest UWP version from the Microsoft Store.

  • Environment: We currently manage 6,146 secrets, with a projected growth to ~10,000 by the end of the year.

  • Usage: As an IT consultancy firm, our technicians require access to the vast majority of these credentials to manage client infrastructure. Segmenting access is not a viable solution for our operational requirements.

Steps to Reproduce:

  1. Open the Passbolt UWP app on Windows.

  2. Log in with a user account that has permission to a large number of secrets (6,000+).

  3. The folder structure loads correctly.

  4. After a few seconds, the app displays the “Failed to load/update resources” error, and no secrets are displayed at any time.

Troubleshooting performed:

  • Verified server health (see output below).

  • Checked server-side error logs (no anomalies found during sync attempts).

  • Stress Testing: I performed a controlled test with a new user account:

    1. Empty State: Worked perfectly on both Chrome (Web) and the Windows UWP App.

    2. Low Volume: Shared 10 secrets; both Chrome and UWP App remained functional.

    3. Full Volume: Once the account was granted access to the full dataset (6,000+ secrets), the UWP App started failing with the mentioned error, while the Chrome Web interface continues to work perfectly.

This confirms that the issue is specific to the UWP client’s handling of large volumes of encrypted resources.

Healthcheck Output:

sudo su -s /bin/bash -c "/usr/share/php/passbolt/bin/cake passbolt healthcheck" www-data

     ____                  __          ____
    / __ \____  _____ ____/ /_  ____  / / /_
   / /_/ / __ `/ ___/ ___/ __ \/ __ \/ / __/
  / ____/ /_/ (__  |__  ) /_/ / /_/ / / /
 /_/    \__,_/____/____/_.___/\____/_/\__/

 Open source password manager for teams
-------------------------------------------------------------------------------
 Healthcheck shell
 If you want to have more information about the different checks, please take a look at the documentation: https://www.passbolt.com/docs/admin/server-maintenance/passbolt-api-status/.
-------------------------------------------------------------------------------

 Environment

 [INFO] Linux [redacted] 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
 [PASS] PHP version 8.3.6.
 [PASS] PHP version is 8.2 or above.
 [PASS] 64-bit architecture system detected.
 [INFO] gpg (GnuPG) 2.4.4 / libgcrypt 1.10.3
 [PASS] PCRE compiled with unicode support.
 [PASS] Mbstring extension is installed.
 [PASS] Intl extension is installed.
 [PASS] GD or Imagick extension is installed.
 [PASS] The temporary directory and its content are writable and not executable.
 [PASS] The logs directory /var/log/passbolt/ and its content are writable.
 [PASS] System clock is synchronized and NTP service is active.

 Config files

 [PASS] The application config file is present
 [PASS] The passbolt config file is present

 Core config

 [PASS] Cache is working.
 [PASS] Debug mode is off.
 [PASS] Unique value set for security.salt
 [PASS] Full base url is set to https://[redacted]:15443
 [PASS] App.fullBaseUrl validation OK.
 [PASS] /healthcheck/status is reachable.

 SSL Certificate

 [PASS] SSL peer certificate validates.
 [PASS] Hostname is matching in SSL certificate.
 [PASS] Not using a self-signed certificate.

 SMTP settings

 [PASS] The SMTP Settings plugin is enabled.
 [PASS] SMTP Settings coherent. You may send a test email to validate them.
 [PASS] The SMTP Settings source is: database.
 [WARN] The SMTP Settings plugin endpoints are enabled.
 [HELP] It is recommended to disable the plugin endpoints.
 [HELP] Set the PASSBOLT_SECURITY_SMTP_SETTINGS_ENDPOINTS_DISABLED environment variable to true.
 [HELP] Or set passbolt.security.smtpSettings.endpointsDisabled to true in /etc/passbolt/passbolt.php.
 [PASS] No custom SSL configuration for SMTP server.

 JWT Authentication

 [PASS] The JWT Authentication plugin is enabled.
 [PASS] The /etc/passbolt/jwt/ directory is not writable.
 [PASS] A valid JWT key pair was found.

 GPG Configuration

 [PASS] PHP GPG Module is installed and loaded.
 [PASS] The environment variable GNUPGHOME is set to /var/lib/passbolt/.gnupg.
 [PASS] The directory /var/lib/passbolt/.gnupg containing the keyring is writable by the webserver user.
 [PASS] The server OpenPGP key is not the default one.
 [PASS] The public key file is defined in /etc/passbolt/passbolt.php and readable.
 [PASS] The private key file is defined in /etc/passbolt/passbolt.php and readable.
 [PASS] The server key fingerprint matches the one defined in /etc/passbolt/passbolt.php.
 [PASS] The server public key defined in the /etc/passbolt/passbolt.php (or environment variables) is in the keyring.
 [PASS] There is a valid email id defined for the server key.
 [PASS] The public key can be used to encrypt a message.
 [PASS] The private key can be used to sign a message.
 [PASS] The public and private keys can be used to encrypt and sign a message.
 [PASS] The private key can be used to decrypt a message.
 [PASS] The private key can be used to decrypt and verify a message.
 [PASS] The public key can be used to verify a signature.
 [PASS] The server public key format is Gopengpg compatible.
 [PASS] The server private key format is Gopengpg compatible.

 Application configuration

 [PASS] Using latest passbolt version (5.13.0).
 [PASS] Passbolt is configured to force SSL use.
 [PASS] App.fullBaseUrl is set to HTTPS.
 [PASS] Selenium API endpoints are disabled.
 [PASS] Search engine robots are told not to index content.
 [INFO] The Self Registration plugin is enabled.
 [INFO] The self registration provider is: Email domain safe list.
 [PASS] The deprecated self registration public setting was not found in /etc/passbolt/passbolt.php.
 [PASS] Host availability will be checked.
 [PASS] Serving the compiled version of the javascript app.
 [WARN] Some email notifications are disabled by the administrator.
 [PASS] The database schema is up to date.
 [PASS] The edition served is CE.

 Database

 [PASS] The application is able to connect to the database
 [PASS] 53 tables found.
 [PASS] Some default content is present.
 [PASS] The database version is supported.

 Metadata

 [PASS] The server is able to decrypt the metadata private key.
 [PASS] Active metadata key found or not required.
 [PASS] The server has access to the metadata keys or does not require access to it.
 [PASS] The server metadata private key is valid.

 [PASS] No error found. Nice one, sparky!

Logs (last 100 lines):

Client IP: [redacted for privacy]
2026-05-11 13:57:38 error: The access token provided for '/resources.json' is not valid.
2026-05-11 13:57:57 error: The access token provided for '/metadata/session-keys/5cbea1e0-189b-4942-af4d-448131dc086f.json' is not valid.
2026-05-11 14:00:46 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/5cbea1e0-189b-4942-af4d-448131dc086f.json?api-version=v2
Client IP: [redacted for privacy]
2026-05-11 14:02:57 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/5cbea1e0-189b-4942-af4d-448131dc086f.json?api-version=v2
Client IP: [redacted for privacy]
2026-05-14 07:16:51 error: [Cake\Http\Exception\InvalidCsrfTokenException] Tipo de cookie CSRF incorrecta o no encontrada. in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php on line 354
Request URL: /auth/logout.json?api-version=v2
Client IP: [redacted for privacy]
2026-05-14 07:16:51 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json?api-version=v2
Client IP: [redacted for privacy]
2026-05-14 11:59:43 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json
Client IP: 127.0.0.1
2026-05-14 12:00:08 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json
Client IP: 127.0.0.1
2026-05-14 12:03:00 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json
Client IP: 127.0.0.1
2026-05-15 10:34:58 error: The access token provided for '/resources.json' is not valid.
2026-05-18 08:29:25 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/5f824fb9-c393-4533-b4a9-03e3dab48a3f.json?api-version=v2
Client IP: [redacted for privacy]
2026-05-18 09:20:56 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/5f824fb9-c393-4533-b4a9-03e3dab48a3f.json?api-version=v2
Client IP: [redacted for privacy]
2026-05-18 13:11:58 error: [Cake\Http\Exception\BadRequestException] You are already logged in. in /usr/share/php/passbolt/src/Controller/Auth/AuthLoginController.php on line 92
Request URL: /auth/login.json?api-version=v2
Client IP: [redacted for privacy]
2026-05-18 15:02:33 error: [Cake\Http\Exception\NotFoundException] Este usuario no existe o ha sido eliminado. Por favor, regístrese y complete la configuración primero. in /usr/share/php/passbolt/src/Service/Users/UserRecoverService.php on line 202
Request URL: /users/recover.json?api-version=v2
Referer URL: https://[redacted for privacy]:15443/auth/login?redirect=%2F&locale=es-ES
Client IP: [redacted for privacy]
2026-05-18 15:13:42 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json
Client IP: 127.0.0.1
2026-05-18 15:16:21 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json
Client IP: 127.0.0.1
2026-05-19 08:56:21 error: [Cake\Http\Exception\ForbiddenException] Solo se permite a los invitados proceder a la recuperación de la cuenta. in /usr/share/php/passbolt/src/Controller/Setup/RecoverStartController.php on line 59
Request URL: /setup/recover/3f0fc595-773c-4d96-bacc-2388a7668742/156c7fd4-03f7-4906-887b-a1b80943c789.json?api-version=v2
Referer URL: https://[redacted for privacy]:15443/setup/recover/start/3f0fc595-773c-4d96-bacc-2388a7668742/156c7fd4-03f7-4906-887b-a1b80943c789?case=default
Client IP: [redacted for privacy]
2026-05-19 08:56:21 error: [Cake\Http\Exception\ForbiddenException] Solo se permite a los invitados proceder a la recuperación de la cuenta. in /usr/share/php/passbolt/src/Controller/Setup/RecoverStartController.php on line 59
Request URL: /setup/recover/start/3f0fc595-773c-4d96-bacc-2388a7668742/156c7fd4-03f7-4906-887b-a1b80943c789.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-01 12:08:23 error: [Cake\Http\Exception\InvalidCsrfTokenException] Tipo de cookie CSRF incorrecta o no encontrada. in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php on line 354
Request URL: /auth/logout.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-01 12:08:23 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-03 11:06:47 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/5f824fb9-c393-4533-b4a9-03e3dab48a3f.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-03 14:03:57 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/5f824fb9-c393-4533-b4a9-03e3dab48a3f.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 07:19:36 error: [Cake\Http\Exception\InvalidCsrfTokenException] Tipo de cookie CSRF incorrecta o no encontrada. in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php on line 354
Request URL: /auth/logout.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 07:19:36 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 18:38:27 error: [Cake\Routing\Exception\MissingRouteException] A route matching `/ee/subscription/key.json` could not be found. in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Routing/RouteCollection.php on line 188
Request URL: /ee/subscription/key.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 18:53:07 error: [Cake\Routing\Exception\MissingRouteException] A route matching `/ee/subscription/key.json` could not be found. in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Routing/RouteCollection.php on line 188
Request URL: /ee/subscription/key.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 19:55:07 error: [Cake\Http\Exception\ForbiddenException] Solo se permite a los invitados iniciar la configuración. in /usr/share/php/passbolt/src/Controller/Setup/SetupStartController.php on line 57
Request URL: /setup/start/7823d26d-d320-46ae-b766-7890341d4526/a8127be6-8c63-444a-9fe5-725d4d71055a.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 19:55:07 error: [Cake\Http\Exception\ForbiddenException] Solo se permite a los invitados iniciar la configuración. in /usr/share/php/passbolt/src/Controller/Setup/SetupStartController.php on line 57
Request URL: /setup/install/7823d26d-d320-46ae-b766-7890341d4526/a8127be6-8c63-444a-9fe5-725d4d71055a.json?api-version=v2
Referer URL: https://[redacted for privacy]:15443/setup/start/7823d26d-d320-46ae-b766-7890341d4526/a8127be6-8c63-444a-9fe5-725d4d71055a?locale=es-ES
Client IP: [redacted for privacy]
2026-06-12 20:02:24 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json
Client IP: 127.0.0.1
2026-06-12 20:06:27 error: [Cake\Routing\Exception\MissingRouteException] La ruta de desconexión solo debe ser accesible con el método POST. in /usr/share/php/passbolt/src/Controller/Auth/AuthLogoutController.php on line 68
Request URL: /auth/logout.json
Client IP: 127.0.0.1
2026-06-12 20:07:34 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/8c5dfac7-9b89-4230-9e10-f868ac2b0f1a.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 20:07:34 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/8c5dfac7-9b89-4230-9e10-f868ac2b0f1a.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 20:07:34 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/8c5dfac7-9b89-4230-9e10-f868ac2b0f1a.json?api-version=v2
Client IP: [redacted for privacy]
2026-06-12 20:07:34 error: [Cake\Http\Exception\ConflictException] Los datos de la clave de sesión de los metadatos han cambiado. in /usr/share/php/passbolt/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php on line 85
Request URL: /metadata/session-keys/8c5dfac7-9b89-4230-9e10-f868ac2b0f1a.json?api-version=v2
Client IP: [redacted for privacy]

Any guidance on whether this is a known limitation of the UWP client or if there are any specific timeout/memory configurations we can adjust on the server/client side to support this volume would be greatly appreciated.

Additional Symptoms: We have also identified related issues when performing bulk operations, which suggest a systemic limitation in processing our dataset:

  1. Group Membership: Adding a new user to the group containing these shared secrets fails via the GUI due to timeout errors. We can only perform this action via CLI by using: passbolt update group --id [GROUP-ID] --user [USER-ID] --serverAddress "[SERVER-URL]" --tlsSkipVerify --timeout 15m.

  2. Exporting Secrets: Exporting a large batch of secrets (exceeding ~60 items) consistently results in an error in the Web GUI.

We suspect these operations and the UWP client issue share the same root cause. We are prepared to provide further logs for these operations if needed.

2

Hey @freecom.daniel

Yes this is a known limitation of the windows application. For now we do not have a direct solution for it, we need to plan a workaround to solve this limitation

Sorry for that

3

Thanks for the transparency, @scadra,

Since this issue is causing significant friction in our daily operations, impacting not just the Windows app, but also our browser extension and Android usage, could you clarify if there is a timeline or a general roadmap to address these scalability issues?

We need to plan our infrastructure accordingly, so knowing whether this is a priority for upcoming development would be very helpful.

Regards!