Organisation collections and websockets

[CyBiS]

Subject of the issue

Websockets don't seem to be working when adding/editing entries within collections of an organisation. Websockets for entries outside an organisation are working fine. Anyone else observing this issue?

Your environment

• Bitwarden_rs version: 1.13.0-a03db6d2
• Install method: Docker image
• Clients used: Official Bitwarden desktop app v1.16.6 (Windows) and official Firefox browser extension v1.41.0.
• Reverse proxy and version: nginx v1.15.7
• Other relevant information: Websockets with default (non-organisation) entries is working fine.

Steps to reproduce

Create new entry within an organisation/collection in the browser extension/desktop app and check if the entry appears in the dekstop app/browser extension.

Expected behaviour

Entry appears instantly.

Actual behaviour

Entry does not appear.

[tomuta]

Interestingly, this doesn't even work on vault.bitwarden.com. I found that the websocket notification is sending the wrong update type, which caused the web app to not fetch the new cipher. However, after fixing this, it seems like it now is fetching it, but it still doesn't update the web ui. I'm not sure what else might be wrong, it might be related to collections maybe. I noticed that on vault.bitwaden.com I have to check the "Default collection" checkbox in order to be able to create an item (bitwarden_rs does not require this), but even if I do check it, it still doesn't work...

[CyBiS]

@tomuta thanks a lot for the confirmation. So is my understanding correct that this is also an issue with the official bitwarden server?

[tomuta]

@CyBiS , it seems like it. Try registering a free account on bitwarden.com and see if you can replicate the issue there as well. Would be helpful to confirm.

[CyBiS]

Organisations are a premium feature and not included in the free account. Judging by this old thread in the official forums, I'd say it might be an issue in the official implementation as well.

[tomuta]

I did not have a premium account and was able to use (simple) organizations just fine with the free account. It may not be the full feature set, but I was able to reproduce (at least what I thought) what you saw there, too.

[CyBiS]

Indeed, the free account allows for an organization with only 2 users and overall 2 collections. Thanks for pointing that out.

I can confirm that this bug is also present in the official implementation. Steps to reproduce:

1. Create a free account on www.bitwarden.com and log in to the web vault and another client like the desktop app or the browser extension.
2. Create a test organisation and a test collection within that organization in the web vault.
3. Create a test entry within that collection in the web vault.
4. Observe that the entry is not shown in the other client within the test collection as long as no manual synchronization is performed. Please note that the entry is synced instantly within the (default) folder though. Only the collection is not synched automatically.
5. Deletion of the item is synchronized instantly within both the folder and the collection.

The the bitwarden_rs implementation behaves similarly with the only exception that the snychronization within the folder isn't working either.

[MartB]

See: https://github.com/bitwarden/server/blob/462303e701caf52800f97cc8a3fad74b949d9231/src/Core/Services/Implementations/NotificationHubPushNotificationService.cs#L53-L61

This might be part of the reason why it doesn't sync on the official bitwarden implementation.

[BlackDex]

I actually think this could be a bug/missing feature on our side.
We apparently do not send the collectionId with our websocket notify request.
It could very well be the issue.

This is something we need to look into.

[BlackDex]

Well, it does indeed looks like they do not do that for new ciphers only added to a collection.
But still, they do add the CollectionIds sometimes, but only using the push services for the mobile clients if i'm correct.
So, i think we can not fix this on our side by just sending the id's with it. They have that disabled for a security reason it seems.

[BlackDex]

Since this is probably not something we can fix on our side, i will move this to discussions.
Also, it seems that currently websockets are broken at all on the bitwarden server side i tried to test it just now, and it doesn't work at all. There is also an issue regarding this: bitwarden/server#1178