Use reverse-proxy-verified mTLS as an alternative second factor

[seyfu-t]

I was thinking about hardening my internet reachable Vaultwarden instance. I thought about implementing 2FA, the only reasonable approach for my case would be TOTP, but I find TOTP quite annoying.

So I thought about mTLS and to my surprise I stumbled upon this blog post, so a working setup is possible.

But enforcing mTLS would kill a bit of convenience, especially if i want to just quickly login to my vault from a rarely used device.

So I propose a middle-ground solution: allowing TOTP to be skipped when the reverse proxy forwards a specific trusted header.
This is possible in Caddy and Traefik at the very least. They have verify_if_given and VerifyClientCertIfGiven respectivley in their client certificate settings which allows checking mTLS if provided and other-wise just letting the connection pass.

So in short the expected behavior should look like this:

• Valid client certificate => Skip the normal 2FA challenge.
• No client certificate => Require normal 2FA
• 2FA disabled for the account => Existing behavior remains unchanged.

I propose to add these optional env vars:

• MTLS_2FA_ENABLED of type boolean
• MTLS_2FA_HEADER of type string

I'd suggest reusing and enforcing IP_HEADER_TRUSTED_PROXIES, when this feature is supposed to be enabled, to prevent arbitrary clients from supplying the authentication header themselves.

In the future this feature could be extended even further by storing certificates in Vaultwarden itself so that certificates can be mapped to specific users.

I'd be happy to (try and) implement this and submit a PR. Though before starting, I wanted to gather some feedback on the idea.

Somewhat related issues:
#6833, #2267