Web Vault login failure: this.subtle is null

[fredrikekre]

Subject of the issue

Today I could not log in to the web vault, when posting the credentials I get the following pop-up and log in fails:

I can still interact with the server with the bitwarden CLI and using the Firefox plugin. I have not tried restarting yet so in case you want some more debuginfo the problem is still reproducing here.

Your environment

• Bitwarden_rs version: Version 1.14.1-843604c9

• Install method: docker (bitwardenrs/server@sha256:043e294847130f08ae9eb355caf00855b013b851c66628c8fba25a5c21819942)
• Clients used: Built-in web vault
• Reverse proxy and version: N/A
• Version of mysql/postgresql: 3.27.2 2019-02-25 16:06:06 bd49a8271d650fa89e446b42e513b595a717b9212c91dd384aab871fc1d0alt1
• Other relevant information:

Steps to reproduce

Not sure how to reproduce, the server has been up for ~1 week now without any problems at all, this just started showing up today.

Relevant logs

Server log from sending credentials:

bitwarden_1  | 2020-04-09T10:04:20.463681211Z [2020-04-09 10:04:20][request][INFO] POST /api/accounts/prelogin
bitwarden_1  | 2020-04-09T10:04:20.473792971Z [2020-04-09 10:04:20][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK

[fredrikekre]

Ah, looks like https://bitwardenrs.discourse.group/t/error-with-latest-firefox-upgrade-ver75/66. That is annoying for just running a local server...

Sorry for the noise, but at least this issue may help others find the solution.

[Link009]

Hi

I have the same issue. bitwarden_rs hosted in Docker on a Synology NAS. How do I solve this other than "enable HTTPS" ? This seems so easy to say but I am not fully aware of what I have to do..

Thanks

[ardunn]

I'm having this issue as well, seemingly works on no mainstream browser. Worked until recently. I'm running a local server...

[dani-garcia]

All the major browsers have blocked the use of their encryption APIs on anything that they consider insecure, Chrome has been doing it for years now and Firefox has started doing it in the latest version.

That means effectively that the only way to use bitwarden_rs now is using HTTPS, that said you can use self signed certificates if you don't have a domain name, but you'll get a browser warning each time.

[fredrikekre]

but you'll get a browser warning each time

At least in Firefox you can add it permanent, so it will just warn on first use.

[Link009]

Is there any chance that the issue can be solved BW side ? I read a few tutorials and I can't say, for me, are the easier ways to solve the problem.

[dani-garcia]

Well we could generate a self signed certificate, but that's really easy to do anyway, so I don't see the point.

To generate them you can use the openssl cli like this:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

You could also use something like mkcert or even https://www.selfsignedcertificate.com/

Then to enable it change the config like the wiki mentions: https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-HTTPS

[ardunn]

That's not working for me, even after following the bitwarden_rs Enabling HTTPS guide I get the following log error:

Logger failed to initialize: attempted to set a logger after the logging system was already initialized
[2020-05-08 07:19:10][rocket::config::error][ERROR] I/O error while setting tls.certs:

This is after setting the generated files to have read permissions for everyone...

[ardunn]

@dani-garcia do I need to change something else? My docker run command is:

docker run -d --name bitwarden -v /local/path/to/data/:/data/ -v /local/path/to/ssl/:/ssl/ -p EXTERNAL_PORT:80 -e ROCKET_TLS='{certs="/local/path/to/ssl/certs.pem",key="/local/path/to/ssl/key.pem"}' bitwardenrs/server:raspberry

[jjlin]

@ardunn The ROCKET_TLS certs/key paths need to be from the perspective of the container, so ROCKET_TLS='{certs="/ssl/certs.pem",key="/ssl/key.pem"}'.

[ardunn]

Thanks! That seemed to get the service up working, but when I try to access it via browser, I get no connection/connection refused. It was working previously with same config (minus SSL), any ideas on how to troubleshoot?

[Link009]

I (hope) successfully generated my cert.pem and key.pem files (stored in volume1). When I tried to add the variable ROCKET_TLS to docker as environment variable, I could not set up and run bitwarden docker image.
Using the command
docker run -d --name bitwarden -e ROCKET_TLS='{certs="/volume1/cert.pem",key="/volume1/key.pem"}' -v /ssl/keys/:/ssl/ -v /bw-data/:/data/ -p 443:80 bitwardenrs/server:latest
gives me the following error:
docker: Error response from daemon: Conflict. The container name "/bitwarden" is already in use by container "e24c1c364fffbb49001a726d3f705d3c6bc2ea1c6302822ae662218467ca4669". You have to remove (or rename) that container to be able to reuse that name.

[jjlin]

Please move these questions to https://bitwardenrs.discourse.group/ for further assistance; they aren't relevant to the original topic, and aren't issues in the software.

[Link009]

I made a tutorial on this for people who don't know how to handle the error: https://lucians.dev/solve-bitwardenrs-this-subtle-is-null-error

[Timshel]

For those just wanting to bypass it when debugging locally:

There is a setting in Firefox to add domains (ref) :

• dom.securecontext.allowlist : it probably does not exists, create it as a string and add your host.

This way you can bind your external ip to test mobile applications and still test in FF.