Fido2 Webauthn broken on latest version of Android app (2.13.0)

[krzmaz]

Subject of the issue

It seems that with the recent version of the mobile app some changes were introduced to FIDO2 Webauthn authentication - bitwarden/mobile#1519
After updating, there is a 404 error when trying to authenticate, as the app is trying to connect to an unimplemented endpoint, example below:
https://vault.mydomain.com/webauthn-mobile-connector.html?data=[DATA]=&parent=bitwarden%3A%2F%2Fwebauthn-callback&v=2

Deployment environment

• vaultwarden version: 1.22.2

• Install method: docker image

• Clients used: Android

• Reverse proxy and version:

• MySQL/MariaDB or PostgreSQL version:

• Other relevant details:

Steps to reproduce

Try to authenticate with Fido2 Webauthn using the latest (2.13.0) mobile app

Expected behaviour

Authentication is possible

Actual behaviour

Error 404 happens

Troubleshooting data

[BlackDex]

I think it should work fine. Are you using a reverse proxy, and if so which one? Does it has caching functionally? Did you clear the cache if so?

[BlackDex]

Sorry, i just saw that this specific endpoint is available within the current testing image, and thus already fixed. But not in the current latest version

Either use the testing image or wait for a new release.

[krzmaz]

Thank you for the quick response!
The latest testing docker image is panicking and not starting on my Raspberry Pi 4, so I guess I'll wait for a release :)
Thank you for all the work on this project!

[krzmaz]

That's the wrong platform for raspberry pi:

Status: Downloaded newer image for vaultwarden/server@sha256:56c50760118afc2a8006492ed51b2476ae4974444e9754b1d05153f0e2c51cc1                             WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm/v7) and no specific platform was requested
standard_init_linux.go:228: exec user process caused: exec format error
DEBU[0051] [hijack] End of stdout
DEBU[0051] Error resize: Error response from daemon: Container 9ed3201b045ba4 84484c849cf7c8e611150261fdaf99e732efb82f8e5d384a4 is not running

[BlackDex]

Ah, then in that case use this for armv7:

docker --debug run --rm -it --name vaultwarden -e RUST_BACKTRACE=1 -e LOG_LEVEL=trace -p 8090:80 vaultwarden/server:testing@sha256:9362f67521460310f78b524cdbe4fc8d9029aa0113d0a8ecdde9f3d0e9e0b0b5

[krzmaz]

No luck:

~/vw-data $ docker --debug run --rm -it --name vaultwarden -e RUST_BACKTRACE=1 -e LOG_LEVEL=trace -p 8090:80 vaultwarden/server:testing@sha256:9362f67521460310f78b524cdbe4fc8d9029aa0113d0a8ecdde9f3d0e9e0b0b5
/--------------------------------------------------------------------\
|                        Starting Vaultwarden                        |
|                      Version 1.22.2-b4c95fb4                       |
|--------------------------------------------------------------------|
| This is an *unofficial* Bitwarden implementation, DO NOT use the   |
| official channels to report bugs/features, regardless of client.   |
| Send usage/configuration questions or feature requests to:         |
|   https://vaultwarden.discourse.group/                             |
| Report suspected bugs/issues in the software itself at:            |
|   https://github.com/dani-garcia/vaultwarden/issues/new            |
\--------------------------------------------------------------------/

[INFO] No .env file found.

thread panicked while processing panic. aborting.
DEBU[0003] [hijack] End of stdout
~/vw-data $

I've even tested older images, and had the same results:

/--------------------------------------------------------------------\
|                        Starting Vaultwarden                        |
|                      Version 1.22.2-d5ed2ce6                       |
|--------------------------------------------------------------------|
| This is an *unofficial* Bitwarden implementation, DO NOT use the   |
| official channels to report bugs/features, regardless of client.   |
| Send usage/configuration questions or feature requests to:         |
|   https://vaultwarden.discourse.group/                             |
| Report suspected bugs/issues in the software itself at:            |
|   https://github.com/dani-garcia/vaultwarden/issues/new            |
\--------------------------------------------------------------------/

[INFO] No .env file found.

thread panicked while processing panic. aborting.
DEBU[0059] [hijack] End of stdout

I will try to do a bisect to find the failing image, but that's a quite manual process...

[krzmaz]

Update:
Image Version 1.22.2-0d2b3bfb works, so the regression was introduced somewhere between 0d2b3bf and d5ed2ce

[BlackDex]

I just started that same image on my rpi, and i get an error also, though it is later in the start process, and i do get a normal panic, and the rest just continues.

[BlackDex]

Could you create a new ticket regarding this panic please?
And also mention which specific rpi you have.

An output of cat /proc/cpuinfo in that ticket would also be nice.

[krzmaz]

Sure, created #1998 with the summary of my findings