Problem reading security key when trying to register yubikey for WebAuthn

[RT-Tap]

Hey, I just got this up and running and all seems pretty good so for so I wanted to say thank you to all who helped put this together.

The issue I have is when I try to add a yubikey for WebAuthn it keeps telling me "There was a problem reading security key. Try again." and I can't seem to get it to work. This key works as I have it setup and working with multiple other services and it has no problem working with the Yubikey OTP feature it's just the WebAuthn that doesnt work.

I click read key, it buffers or runs or whatever you want to call it for a second or two and then just displays that error, no popups or dialogues asking to press the key just an error.

Any ideas about why or how I can fix this?

Thank you very much.

[BlackDex]

Check the logs of Vaultwarden.
I suspect it has something to do with the origin domain.
In that case check your DOMAIN config if that is correct and doesn't have a trailing slash.

[RT-Tap]

I checked logs I got a bunch of these

[2021-09-05 22:50:43.307][response][INFO] POST /api/two-factor/get-webauthn (get_webauthn) => 200 OK
[2021-09-05 22:50:52.302][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-05 22:50:53.277][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK
[2021-09-05 22:51:00.675][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-05 22:51:02.603][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK
[2021-09-05 22:51:15.890][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-05 22:51:16.852][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK
[2021-09-05 22:51:17.801][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-05 22:51:18.761][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK

which makes me assume that means it's not a vaultwarden issue and like you said ... an origin domain issue ... but i'm not sure what you mean by that
when you say DOMAIN config, can you give me a little more context?
I have this behind a reverse proxy as a subdomain ... do you mean the sites-available conf file or something else?
If it's the conf file for the subdomain conf file I just checked and don't have any trailing slashes anywhere.

just a little more from log from my most recent attempt at adding webauthn:

[2021-09-06 06:34:05.655][request][INFO] GET /api/two-factor
[2021-09-06 06:34:05.662][response][INFO] GET /api/two-factor (get_twofactor) => 200 OK
[2021-09-06 06:34:19.115][request][INFO] POST /api/two-factor/get-webauthn
[2021-09-06 06:34:20.330][response][INFO] POST /api/two-factor/get-webauthn (get_webauthn) => 200 OK
[2021-09-06 06:34:28.356][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-06 06:34:29.322][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK
[2021-09-06 06:34:31.879][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-06 06:34:32.850][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK
[2021-09-06 06:34:36.626][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-06 06:34:37.593][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK
[2021-09-06 06:35:15.708][request][INFO] GET /api/accounts/profile
[2021-09-06 06:35:15.726][response][INFO] GET /api/accounts/profile (profile) => 200 OK
[2021-09-06 06:35:23.647][request][INFO] GET /api/accounts/revision-date
[2021-09-06 06:35:23.653][response][INFO] GET /api/accounts/revision-date (revision_date) => 200 OK
[2021-09-06 06:35:26.489][request][INFO] GET /api/accounts/profile
[2021-09-06 06:35:26.520][response][INFO] GET /api/accounts/profile (profile) => 200 OK
[2021-09-06 06:35:28.348][request][INFO] GET /api/two-factor
[2021-09-06 06:35:28.354][response][INFO] GET /api/two-factor (get_twofactor) => 200 OK
[2021-09-06 06:35:38.944][request][INFO] POST /api/two-factor/get-webauthn
[2021-09-06 06:35:39.981][response][INFO] POST /api/two-factor/get-webauthn (get_webauthn) => 200 OK
[2021-09-06 06:35:48.182][request][INFO] POST /api/two-factor/get-webauthn-challenge
[2021-09-06 06:35:49.146][response][INFO] POST /api/two-factor/get-webauthn-challenge (generate_webauthn_challenge) => 200 OK

[BlackDex]

Checkout the vw.yourdomain.tld/admin/diagnostics page.
There it will show you some basic misconfiguration issues.

You should have set somewhere what the domain is you are using via the DOMAIN variable.
If that is configure incorrectly it will cause issues with WebAuthn.

[RT-Tap]

OK, so I have no idea what I'm doing wrong I added a DOMAIN environment variable, but it's still saying no match for some reason. I also changed my reverse proxy to the example listed as "Apache (by fbartels)" from https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples but I get no change what so ever, I created a new container from the original and added the DOMAIN variable as shown below.

and I still have the same "issues" no domain match and still have X-Forwarded-For am I missing something here?

[jjlin]

Did you actually read https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview? Your probable issue is literally discussed in the first paragraph...

[RT-Tap]

Yes I did actually and everything is defined as enviroment variables so I'm not sure why something would be overwritten ... if that's the case do i Need to create an .env file and replicate all my setting and use that to set everything up? I'm not entirely sure how to acces the .json file as this is the first time im actually using docker.

[RT-Tap]

I created a new container from scratch and got it working, can you point me in the right directrion as far as fixing the IP-Headers issue? Honestly I thought it was setup correctly originally and am not even sure why this is an issue so any advice is helpfull

[RT-Tap]

Alright I got the IP header issue resolved, however I can't enable email 2FA i just keep getting a popup box that reads "error Saving config undefined"

Any idea what's causing this?