When using challenge-response the database is not locked in some cases

[huugood]

Overview

In addition to my password I use the challenge-response mode with a yubikey. Additionally I have activated the options 'Automatically save when locking database' and 'Lock database when session is locked or lid is closed'.
When locking my laptop without having the yubikey inserted keepassxc tries to lock the database but needs to save it first. Because of the challenge-response mode this needs an interaction with the yubikey. If this interaction doesn't happen the database is not locked but rather just shows a prompt to 'save', 'discard' or 'cancel'. I believe to not be able to access any passwords directly this way, as whatever I click will close the database after running the action, but I can at least read usernames etc. underneath the popup. Using the KeepassXC-Browser extension I am also still able to get it to input passwords as long as this popup is open.

Steps to Reproduce

1. Use challenge-response with a security key
2. Have options 'Automatically save when locking database' and 'Lock database when session is locked or lid is closed' activated
3. remove your security key after the database is unlocked
4. lock your device

Expected Behavior

Even though it leads to dataloss of unsaved edits, I'd argue it to be better to discard all edits and lock the database, if no security key is found. This might lead to the loss of some unsaved edits, but it means the database is always locked when it is to be expected.

Actual Behavior

The database does not lock, because it can't save edits without the security key. This means the database stays unlocked even though you'd expect it to be locked.

KeePassXC - VERSION 2.7.4
Revision: 63b2394

Operating System: Windows 10 Version 2009

[droidmonkey]

#721 - we recommend enabling auto save when using a yubikey