Login with device doesn't work #3835
-
|
Hello Vaultwarden-Community, I tried using the new "login with device" feature, but I can't get it working properly. Web UI: Newest Bitwarden IOS App: Web UI: Using vaultwarden/server:testing |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 18 replies
-
|
It all says ok. So maybe something else is blocking. Have you checked the developer console (F12) if that shows any errors? |
Beta Was this translation helpful? Give feedback.
-
|
It works on my iPad... I still don't get a pop-up on my phone though. And the developer console and network-tab just says, that it connected to the websocket successfully, but nothing more. |
Beta Was this translation helpful? Give feedback.
-
|
I'm on Android, and just tested it via a browser on my phone and it works just fine. I'm not seeing anything strange in your logs. Maybe try to set it the log level to debug. Maybe it shows what goes wrong? |
Beta Was this translation helpful? Give feedback.
-
|
Just tried it on windows both with the webapp and the client. Doesn't work... Didn't get a pop-up, showed up in the list of pending login requests, accepting works, but nothing happens afterwards. |
Beta Was this translation helpful? Give feedback.
-
|
Those aren't the debug logs, those are only info. In the browser developer console, in there network tab there should be a websocket connection visible which shows a Best would be if you provide the support string which you can generate via |
Beta Was this translation helpful? Give feedback.
-
|
I also thought about websockets, but I do see the websocket connection with the 101 code. Your environment (Generated via diagnostics page)
Config (Generated via diagnostics page)Show Running ConfigEnvironment settings which are overridden: {
"_duo_akey": null,
"_enable_duo": false,
"_enable_email_2fa": false,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_smtp_img_src": "cid:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_max_conns": 10,
"database_timeout": 30,
"database_url": "***************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"domain": "*****://*********************",
"domain_origin": "*****://*********************",
"domain_path": "",
"domain_set": true,
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"email_attempts_limit": 3,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"invitation_expiration_hours": 120,
"invitation_org_name": "Bitwarden",
"invitations_allowed": false,
"ip_header": "X-Real-IP",
"job_poll_interval_ms": 30000,
"log_file": "/data/vaultwarden.log",
"log_level": "debug",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 100000,
"push_enabled": false,
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": true,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": null,
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "*****************",
"smtp_from_name": "Bitwarden",
"smtp_host": "****************",
"smtp_password": "***",
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 10,
"smtp_username": "*****************",
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"websocket_address": "0.0.0.0",
"websocket_enabled": false,
"websocket_port": 3012,
"yubico_client_id": "83931",
"yubico_secret_key": "***",
"yubico_server": null
} |
Beta Was this translation helpful? Give feedback.
-
|
Btw. there is an error in the developer console after a few seconds. |
Beta Was this translation helpful? Give feedback.
-
|
I do see the reverse proxy mentioned, so that is fine. We can't determine the reverse proxy application and version our self, so that is for you to fill in ;). But, as suspected, PUSH isn't enabled, which is why you do not receive a notification on your phone. If the websocket's are closing to quickly, then it might be that there are some issues with the reverse proxy and passing through the websockets. |
Beta Was this translation helpful? Give feedback.
-
|
Okay, I fixed it now I think. I enabled push notifications, but they still don't work. |
Beta Was this translation helpful? Give feedback.
-
|
Nice. You are not the first in regards to websockets and cloudflare, strange, as there are ping/pongs send which should keep the connection open. Regarding the push notifications, most people need to fully logout/purge the data of the mobile client for it to register the mobile push token, which is needed to send push messages. |
Beta Was this translation helpful? Give feedback.
-
|
I also have absolutely no clue at the moment why this happens with cloudflare. The websocket connects totally fine, but everything afterwards just stops working completely. It seems like no data is sent from the server to the client. Because the login request goes through, just the accepting response won't reach the client and it times out shortly after. Thanks a lot btw. for all the help :D |
Beta Was this translation helpful? Give feedback.
-
|
@LordByronRS, which reverse proxy do you use? I don't have Cloudflare my self, so I can't test it. (Main reason is i dont want to transfer my DNS fully to Cloudflare.) |
Beta Was this translation helpful? Give feedback.
-
|
I still use Apache as my reverse proxy. I can post the config file in a bit. |
Beta Was this translation helpful? Give feedback.
-
|
Here it is: |
Beta Was this translation helpful? Give feedback.
-
|
Server version: Apache/2.4.57 (Ubuntu) |
Beta Was this translation helpful? Give feedback.
-
|
Then maybe try the following config. <VirtualHost *:443>
ServerAdmin info@xxx.net
ServerName bitwarden.xxx.net
RemoteIPHeader CF-Connecting-IP
SSLEngine on
SSLCertificateFile /root/.acme.sh/xxx.net/fullchain.cer
SSLCertificateKeyFile /root/.acme.sh/xxx.net/xxx.net.key
<Location /admin>
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>
ProxyPass / http://localhost:8008/ upgrade=websocket
ProxyPassReverse / http://localhost:8080/
ProxyPreserveHost On
ProxyRequests Off
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
</VirtualHost>
|
Beta Was this translation helpful? Give feedback.
-
|
Works without cloudflare, but not with cloudflare. |
Beta Was this translation helpful? Give feedback.
-
|
I had the same problem but got it working in the end. Using Cloudflare and SWAG (Nginx Reverse Proxy). I had to explicitly add the following lines to my proxy configuration for vaultwarden, to keep the websocket open.
So it looks like this: `server { |
Beta Was this translation helpful? Give feedback.
-
This should be the proper answer. I was using a synology NAS with nginx reverse proxy, and I forgot to add the proxy headers. This works with cloudflared and also when using behind corporate SSL certificates. |
Beta Was this translation helpful? Give feedback.
-
|
Still trying to control, which device login is offered first, I want it to be Yubikey or Fido2, not this passphrase feature that requires me to configure push etc...is there any way to do this with vaultwarden ? to be clear I have yubikey, webauthN properly configured in my account settings already edit : I do have webAuthN with my yubikey working when i plug the usb-C dongle on my phone, that is, to login to my own vault |
Beta Was this translation helpful? Give feedback.
Nice. You are not the first in regards to websockets and cloudflare, strange, as there are ping/pongs send which should keep the connection open.
Regarding the push notifications, most people need to fully logout/purge the data of the mobile client for it to register the mobile push token, which is needed to send push messages.