Problems connecting to a self-hosted vaultwarden instance behind a Cloudflare tunnel from an android client due to Access policy

[papshmeare]

Your Environment

• vaultwarden Version used: 1.27.0
• Docker Version used: 23.0.1, build a5ee5b1
• Docker compose version used: 3.9
• Operating System and version: Ubuntu 22.04.2 LTS server with a docker compose vaultwarden running through a cloudflared tunnel (Cloudflare Zero Trust) on a personal domain e.g x.domain.com with access policies
• Android app Name and version: Any(f-droid/play store)(current/previous versions[I went up to 2 versions back]) of Bitwarden client

Expected Behavior

Open the bitwarden android app, specify Server URL: https://x.domain.com , enter email, login, enter password, use

Current Behavior

Open the bitwarden android app, specify Server URL: https://x.domain.com , enter email, login -> get
We were unable to process your request. Please try again or contact us.

Steps to Reproduce

1. Download any version of Bitwarden android client from either F-droid or Google play
2. Specify your self-hosted domain pointing to vaultwarden behind a cloudflared tunnel, set access policies
3. Enter email
4. Get error

Can you reproduce this reliably?

Every time I try to login into my self-hosted vaultwarden through Bitwardens android client

Error Log

My Docker container log doesn't register any attempt to connect.

Current ideas

When I use a browser to open my vaultwarden instance everythings works flawlessly. Chrome extension also recognizes and reliably connects to my instance. I have had trouble connecting to my self-hosted applications from android clients before but it was always a CORS issue and when I allowed specific origins in my access policies it usually resolved. In case with Bitwarden I tried adding https://bitwarden.com randomly guessing that this is what the origin might be for the app but to no avail. If anyone knows what is the origin when connecting from the app that would be appreciated. Though, of course, the issue may be in something other than CORS. I also thought that certificates might be the problem(knowing that android can be strict about that) but considering that other applications on my phone are working fine with my domain and digicert passes okay I think that is not the case.


Any help is appreciated! I decided to post this in discussions because Bitwarden is not associated with vaultwarden, nonetheless I hope that someone might have encountered a similar issue here.

P.S Without any access policies the app is working as intended but it poses a security issue so the actual question is how to set up access policies in a way that it lets through bitwarden app?

[GeekCornerGH]

I'm using cloudflare tunnel, I got no issue, would you like to share some logs or config please?

[papshmeare]

Hey, I just read through my post again and I figured I forgot the critical part that I identified as the actual issue. On top of my cloudflare tunnel I set access policies for every application that I run as a security measure. So the actual question would be how do I set up my access policies in a way that bitwarden app can get through? For instance, for Github webhooks in another app I had to whitelist their publicly available hook IPs, for a task manager that sends GET requests to a local instance I had to add a CORS origin and set an auth service token and etc. Do you have any ideas on how to implement this for this scenario?

P.S If I remove any access policies whatsoever the app is working as intended but that poses a security issue.

[GeekCornerGH]

IIRC, Bitwarden official web vault doesn't even has access policies, so that's not the problem

[papshmeare]

IIRC, Bitwarden official web vault doesn't even has access policies, so that's not the problem

I might need to clarify. It is my personal access policies that I set through Cloudflare ZeroTrust > Applications > Self-Hosted. It is possible to filter by email/country/token/ip range/etc. If I don't set any the app works as inteded, if I do try to set them in some way it doesn't which means that my Cloudflare access policies need to be revised in a way that Bitwarden client can connect through them(for example, IP ranges or some kind of mTLS setup)

For example, if I am using open source tools then I can authenticate my clients through a Service Auth token by altering the codebase to send an auth request prior to any others but in case of closed sourced systems it is a bit trickier and requires whitelisting by some other means.

[GeekCornerGH]

If you're using access, then yeah it might cause issues too, how would you filter by email too?

[papshmeare]

If you're using access, then yeah it might cause issues too, how would you filter by email too?

Yeah unfortunately it does cause problems because if you introduce any authentication that involves user interaction like emails/single time pin/etc it creates and intermediary page where you have to confirm your credentials which confuses most automated clients(and it should). The usual workaround for automated services is using Service Auth Tokens but it only works if you can alter the codebase/modify requests that are sent by your apps to include custom Headers with said token. Other ways would be to whitelist by CN of certificates if connections come from web resources or whitelist by IP ranges if you happen to know them for a given service. I filter most of my apps by emails by using ZeroTrust Applications interface by creating self-hosted applications there and setting access policies like "Include -> Emails -> list_emails_here" and then only people who authorized with given Gmail accounts can proceed to use the service.

[calvin-li-developer]

I'm not sure if this helps but If you have any special characters in your subdomain this can cause random issues with android app client. Characters such as _ or -. Maybe that is the cause of the error on client.

[papshmeare]

I'm not sure if this helps but If you have any special characters in your subdomain this can cause random issues with android app client. Characters such as _ or -. Maybe that is the cause of the error on client.

I have just updated the topic and answered a comment above to clarify the actual issue - which is access policies i.e I am struggling to come up with an access policy to let bitwarden client through

[Jordonh18]

I had the same problem. There is a way to bypass this issue using their WARP client. If you need help setting it up then let me know and im happy to walk you through it, but there are many tutorials online that can help. The WARP client basically authenticates the device, whereas when you use the normal access policy where you enter the email, you are authenticating the browser essentially, meaning you can access your sites online from your device.

WARP will allow you to access your sites from desktop applications etc, such as the Bitwarden app.