Skip to content

v1.7.3 - Stronger Two-Step Login and Client Compatibility

Choose a tag to compare

View all tags
@shuaiplus shuaiplus released this 06 Jul 17:51
· 61 commits to main since this release
v1.7.3
a0f832e

Added

  1. YubiKey OTP and passkey two-step login. NodeWarden now supports YubiKey OTP as a managed two-factor provider and adds passkey-based two-factor authentication, including setup screens, WebAuthn fallback connector handling, multi-provider login prompts, and safer WebAuthn response normalization. Commits: f63b745, c019c93, e73ae3d, d8cc88d.

  2. Bitwarden extended vault item types. Vault items now cover bank accounts, driver's licenses, and passports in addition to the existing login, card, identity, secure note, and SSH key flows. The web vault can create, display, decrypt, import, and export these item types with clearer sidebar icons. Commits: 109593d, 9de0d3b.

  3. More Bitwarden client compatibility endpoints. Added device verification settings, device registration routes, admin auth-request compatibility, fill-assist alignment, and push relay installation handling so more official Bitwarden client flows receive expected responses. Unsupported email verification and KDF routes now return explicit unsupported responses instead of ambiguous failures. Commits: e376a84, 8b2f98b, f0e5233, 56b301f, fd46dff, cde4555.

Improved

  1. TOTP QR scanning and Bitwarden-compatible TOTP behavior. Uploading TOTP QR codes now falls back to jsQR when browser BarcodeDetector support is incomplete, handles transparent PNGs correctly, validates uploaded QR images, and throttles camera fallback decoding to reduce CPU usage. TOTP storage and decryption behavior is also aligned more closely with Bitwarden clients. Commits: b0a679b, d024798, 73bbe8b, 6e72220, 8a5b210.

  2. Settings, device management, and localization polish. Device management now lives inside Settings with updated navigation, the two-step provider UI is more responsive, and new settings, audit-log, and validation messages are localized across supported languages. This makes the security settings area easier to scan on desktop and mobile. Commits: c7eb6c6, 062c966, 12af18e, c53d71f, 01ff627.

  3. Encrypted Send password visibility and editing. Password-protected Sends now show a lock indicator in the list, display masked password dots when editing an existing protected Send, and provide a compact trash-icon control for removing the stored password. This makes password state visible without exposing the password itself. Commits: a870142, ebc8e8e.

  4. Website icon behavior and workflow maintenance. Website icons are now always available without the old WEBSITE_ICONS_ENABLED environment toggle, while icon requests keep privacy protections. The global-domains sync workflow also validates its ref before running. Commits: 57c5ef9, c643874, 680e287.

Fixed

  1. Authentication, token, and rate-limit hardening. API keys are stored as hashes, password rotation and JWT handling were tightened, user cache invalidates on token handling, remembered 2FA tokens survive a bad password attempt, the current access-token session is revoked correctly, and known rate-limit reset bypasses were closed. Commits: 1545881, 439683d, 60dd298, d9a36fe, 1bad32f, 2df43cc, ae168be.

  2. User data isolation and request validation. Storage reads are scoped by user, Send file routes gate access more strictly, anonymous notification hub requests are validated, and multipart backup/upload requests now have caps. This reduces the chance of cross-user data reads or oversized requests reaching deeper handlers. Commits: baf5699, 8c481a1, 23c53bd, 5142846.

  3. Backup, restore, and download safety. Remote backup deletes are verified, archives and backup blobs are validated before use, destination secrets are redacted from settings responses, backup/download token flows are harder to misuse, and WebAuthn credential purpose survives backup export/import. A backup uploader redirect guard was also reverted to restore compatible remote behavior. Commits: 0cef6a0, 00e0ec0, 5c8f01b, cc4a830, f532d3a, a366acb.

  4. Import compatibility and encrypted-field validation. Imports now validate payload structure and ZIP entries before processing, and plaintext FIDO2 credential, SSH key, and password-history fields are rejected instead of being silently accepted and later dropped. This makes failed imports clearer and protects encrypted vault fields from incompatible plaintext data. Commits: cf14704, 1ec6ed4.

  5. Admin, audit, WebAuthn, and backup endpoint edge cases. Admin audit-clears are recorded, passkey 2FA status is reported correctly, WebAuthn extension origins are constrained, and auth-request plus backup endpoint checks were tightened around sensitive flows. Commits: d028b19, ace00e8, 7ac6ae5.

新增

  1. YubiKey OTP 和通行密钥两步登录。 NodeWarden 现在支持将 YubiKey OTP 作为可管理的双因素提供商，并新增基于通行密钥的双因素认证，包含设置界面、WebAuthn 备用连接器处理、多提供商登录提示，以及更安全的 WebAuthn 响应规范化。提交：f63b745、c019c93、e73ae3d、d8cc88d。

  2. Bitwarden 扩展保险库条目类型。 除现有登录、银行卡、身份、安全笔记和 SSH 密钥流程外，保险库条目现在还覆盖银行账户、驾驶证和护照。Web 保险库可以创建、展示、解密、导入和导出这些条目类型，并提供更清晰的侧边栏图标。提交：109593d、9de0d3b。

  3. 更多 Bitwarden 客户端兼容端点。 新增设备验证设置、设备注册路由、管理员认证请求兼容、fill-assist 对齐和推送中继安装处理，让更多官方 Bitwarden 客户端流程能获得预期响应。不支持的邮箱验证和 KDF 路由现在会返回明确的不支持响应，而不是含糊失败。提交：e376a84、8b2f98b、f0e5233、56b301f、fd46dff、cde4555。

改进

  1. TOTP 二维码扫描和 Bitwarden 兼容 TOTP 行为。 上传 TOTP 二维码时，如果浏览器 BarcodeDetector 支持不完整，现在会回退到 jsQR，并正确处理透明 PNG、校验上传的二维码图片、限制摄像头回退解码频率以降低 CPU 占用。TOTP 的存储和解密行为也更贴近 Bitwarden 客户端。提交：b0a679b、d024798、73bbe8b、6e72220、8a5b210。

  2. 设置、设备管理和本地化打磨。 设备管理现在整合进设置页并更新了导航，两步验证提供商界面在响应式布局下更顺手，新的设置、审计日志和校验消息也补齐了受支持语言的本地化。安全设置区域在桌面和移动端都更容易浏览。提交：c7eb6c6、062c966、12af18e、c53d71f、01ff627。

  3. 加密 Send 的密码状态展示与编辑。 受密码保护的 Send 现在会在列表中显示锁定标记，编辑已有受保护 Send 时会显示密码掩码圆点，并提供紧凑的垃圾桶图标用于移除已保存密码。这样可以看清密码状态，同时不暴露密码本身。提交：a870142、ebc8e8e。

  4. 网站图标行为和工作流维护。 网站图标现在无需旧的 WEBSITE_ICONS_ENABLED 环境开关即可始终可用，同时图标请求仍保留隐私保护。global-domains 同步工作流也会在运行前校验引用。提交：57c5ef9、c643874、680e287。

修复

  1. 认证、令牌和速率限制加固。 API key 现在以哈希形式存储，密码轮换和 JWT 处理更严格，令牌处理时会使用户缓存失效，错误密码不会丢失已记住的 2FA token，当前访问令牌会被正确撤销，并关闭了已知的速率限制重置绕过路径。提交：1545881、439683d、60dd298、d9a36fe、1bad32f、2df43cc、ae168be。

  2. 用户数据隔离和请求校验。 存储读取现在按用户限定范围，Send 文件路由更严格地拦截访问，匿名通知 hub 请求会被校验，并且多段备份/上传请求增加了上限。这降低了跨用户数据读取或超大请求进入深层处理器的风险。提交：baf5699、8c481a1、23c53bd、5142846。

  3. 备份、恢复和下载安全性。 远端备份删除现在会被验证，归档和备份 blob 使用前会校验，目标配置里的密钥会在设置响应中脱敏，备份/下载令牌流程更难被误用，WebAuthn 凭据用途也会在备份导出/导入中保留。备份上传器的重定向防护也已回退，以恢复兼容的远端行为。提交：0cef6a0、00e0ec0、5c8f01b、cc4a830、f532d3a、a366acb。

  4. 导入兼容性和加密字段校验。 导入流程现在会在处理前校验 payload 结构和 ZIP 条目，明文 FIDO2 凭据、SSH 密钥和密码历史字段会被拒绝，而不是先被静默接受再在响应时丢弃。这让失败导入更清楚，也保护加密保险库字段不接收不兼容的明文数据。提交：cf14704、1ec6ed4。

  5. 管理员、审计、WebAuthn 和备份端点边界情况。 管理员清空审计日志会被记录，通行密钥 2FA 状态会正确上报，WebAuthn 扩展来源会受到限制，并且认证请求与备份端点围绕敏感流程的校验也更严格。提交：d028b19、ace00e8、7ac6ae5。

Assets 2
Loading