Login with device not working

[fhibler]

Hi community,

I am having issues with 'Login with device' via the Web UI + iOS device (for approval).

Server: 1.29.2
Web: 2023.7.1
Client: 2023.9.1

The WebUI is presenting me with a fingerprint - as expected. Also I am getting the Push notification from my iOS client.

When I want to confirm it, I'll get the following error message.

The console logs for the vaultwarden server are giving me the following error message:

[2023-10-08 13:56:17.158][response][INFO] (post_auth_request) POST /api/auth-requests => 200 OK
[2023-10-08 13:56:17.411][request][INFO] GET /notifications/anonymous-hub?Token=ce43e241-dc87-4302-8ef2-
[2023-10-08 13:56:17.411][vaultwarden::api::notifications][INFO] Accepting Anonymous Rocket WS connection from 2003:e8:e724:...
[2023-10-08 13:56:17.411][response][INFO] (anonymous_websockets_hub) GET /notifications/anonymous-hub?<token..> => 200 OK
[2023-10-08 13:56:18.301][request][INFO] PUT /api/devices/identifier/579e57fc-10d9-489f-951c-2987dd2c7b08/token
[2023-10-08 13:56:18.644][response][INFO] (put_device_token) PUT /api/devices/identifier/<uuid>/token => 200 OK
[2023-10-08 13:56:20.418][request][INFO] GET /api/auth-requests/ce43e241-dc87-4302-8ef2-08097be0d102
[2023-10-08 13:56:20.419][response][INFO] (get_auth_request) GET /api/auth-requests/<uuid> => 200 OK
[2023-10-08 13:59:21.801][request][INFO] GET /api/auth-requests/ce43e241-dc87-4302-8ef2-08097be0d102
[2023-10-08 13:59:21.802][response][INFO] (get_auth_request) GET /api/auth-requests/<uuid> => 200 OK
[2023-10-08 13:59:22.046][request][INFO] PUT /api/auth-requests/ce43e241-dc87-4302-8ef2-08097be0d102
[2023-10-08 13:59:22.046][vaultwarden::api::core::accounts::_][WARN] Data guard `Json < AuthResponseRequest >` failed: Parse("{\"key\":\"4.OgkWvjuJmxqmBSwCUwRHANZgPo2uWlPMvN1SIvQzzY/gJuP1dQKAGkafscjzf7Njw1cmi6sOGjKtEsOHgGQYg528P9t8Kplyl/moqtQ7DTKZv2ym0SiZrRhRzJV/S3kdbYLT6rYQeXSmudFzkwCKiSAwEylzil8SnLQ8vxZnO59lEW1zOfduiemWhWsHaDNg7aiLgWVF5AsmRssvg34fsX3xPDl2j/vN0D4FQ3X6DWjlliyOlNbsfe+x2izqNVNbSTjtBXZJiXXd45XqkazeL/cXGgpncPr2bn15QWXIZs7nrayhowYbgSBsQWAAyI67nZQSiJo97MTadl4B3q+2Bw==\",\"masterPasswordHash\":null,\"deviceIdentifier\":\"579e57fc-10d9-489f-951c-2987dd2c7b08\",\"requestApproved\":true}", Error("invalid type: null, expected a string", line: 1, column: 381)).
[2023-10-08 13:59:22.046][response][INFO] (put_auth_request) PUT /api/auth-requests/<uuid> => 422 Unprocessable Entity
[2023-10-08 13:59:33.520][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL

Any idea whats going on and how I could fix it?

Thanks a bunch and best regards,
Florian

[stefan0xC]

Try the testing image as it includes #3831 which should fix the issue.

[mrizvic]

These are from nginx.conf under server section:

        location / {
            proxy_http_version 1.1;
            proxy_set_header "Connection" "";

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_pass http://vaultwarden-default;
        }

        location /notifications/hub/negotiate {
            proxy_http_version 1.1;
            proxy_set_header "Connection" "";

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_pass http://vaultwarden-default;
        }

        location /notifications/hub {
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Forwarded $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_pass http://vaultwarden-ws;
        }

        location /admin {
            # See: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/
            allow REDACTED;
            deny all;

            proxy_http_version 1.1;
            proxy_set_header "Connection" "";

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_pass http://vaultwarden-default;
        }

[mrizvic]

And upstreams:

    upstream vaultwarden-default {
        zone vaultwarden-default 64k;
        server vaultwarden:80;
        keepalive 2;
    }

    upstream vaultwarden-ws {
        zone vaultwarden-ws 64k;
        server vaultwarden:3012;
        keepalive 2;
    }

[stefan0xC]

You are using both the old and the new WebSockets ports, so it probably does not work because of this. Since 1.29.0 the separate 3012 port is not necessary anymore. And I'm not sure if it is compatible with the new /notifications/anonymous-hub endpoint.

vaultwarden/src/api/notifications.rs

Lines 189 to 190 in ecb31c8

	#[get("/anonymous-hub?<token..>")]
	fn anonymous_websockets_hub<'r>(

[BlackDex]

The anonymouse websocket is not compatible with the old 3012 port.
We also tend to remove it from the next release, a PR is already created to remove the 3012 port functionality

[mrizvic]

Thank you. I got it working now!
Its all nicely documented: https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples