Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not having an option to disable the websocket notification #3975

Closed
lyc8503 opened this issue Oct 14, 2023 · 5 comments
Closed

Not having an option to disable the websocket notification #3975

lyc8503 opened this issue Oct 14, 2023 · 5 comments

Comments

@lyc8503
Copy link

lyc8503 commented Oct 14, 2023

Subject of the issue

After updating to v1.29.0, websockets are enabled by default on the HTTP port. But I'd like to disable that.

Steps to reproduce

Just run vaultwarden, and by default it enables Rocket WS which I don't find an option disable.
setting WEBSOCKET_ENABLED to false doesn't work as it stated in https://github.com/dani-garcia/vaultwarden/wiki/Enabling-WebSocket-notifications

Expected behaviour

Having a new option to forcibly disable the websocket feature.

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.29.2
  • Web-vault version: v2023.7.1
  • OS/Arch: linux/x86_64
  • Running within Docker: true (Base: Alpine)
  • Environment settings overridden: false
  • Uses a reverse proxy: true
  • IP Header check: true (X-Forwarded-For)
  • Internet access: false
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: n/a
  • Domain Configuration Check: true
  • HTTPS Check: true
  • Database type: SQLite
  • Database version: 3.41.2
  • Clients used:
  • Reverse proxy and version:
  • Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_smtp_img_src": "cid:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "/mnt/data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "/mnt/data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "********************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://********************************************",
  "domain_origin": "*****://*******************",
  "domain_path": "*************************",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "/mnt/data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": false,
  "ip_header": "X-Forwarded-For",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "push_enabled": false,
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "/mnt/data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "/mnt/data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "******************",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "******************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "******************",
  "templates_folder": "/mnt/data/templates",
  "tmp_folder": "/mnt/data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": false,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}
@BlackDex
Copy link
Collaborator

That has no use. The clients will still try to connect. So why disable it at all?

If you want to do that, just block it in the reverse proxy.
It's not going to be a good idea do block this globally in my opinion.

@lyc8503
Copy link
Author

lyc8503 commented Oct 14, 2023

Isn't there a way to tell the client there's no websocket support?

I have already tried to block the request in the reverse proxy and it worked, but I think maybe an option could be better.

I am deploying vaultwarden to a serverless platform, and it works well until the v1.29.0 update.
Websocket connections keeps the instance from sleeping and can cost a lot.

@NorthShad0w
Copy link

NorthShad0w commented Oct 18, 2023

@lyc8503 how did you block the /notifications/hub requests? I alse deployed the vaultwarden to the aliyun. Didn't find a way. Now I just set the timeout to 1 second to reduce the cost.

@lyc8503
Copy link
Author

lyc8503 commented Oct 18, 2023

@lyc8503 how did you block the /notifications/hub requests? I alse deployed the vaultwarden to the aliyun. Didn't find a way. Now I just set the timeout to 0.1 second to reduce the cost.

It seems that deploying to serverless platforms like aliyun is not officially supported. So I use a little hack: I just bound the /notifications/hub path to another function which doesn't support websocket, then requests to that endpoint will be rejected by aliyun and costs nothing.

image

@lyc8503
Copy link
Author

lyc8503 commented Oct 18, 2023

As maintainers are not interested in this feature, closing this issue for now.

Workaround: block requests to /notifications/hub via reverse proxy or some platform-specific config

@lyc8503 lyc8503 closed this as not planned Won't fix, can't repro, duplicate, stale Oct 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants