-
Vaultwarden Support StringYour environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)Show Config & DetailsEnvironment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN Config: {
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": false,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "***:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_max_conns": 10,
"database_timeout": 30,
"database_url": "***************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"domain": "*****://*****************",
"domain_origin": "*****://*****************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "fido2-vault-credentials",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 2,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": false,
"ip_header": "X-Real-IP",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": true,
"signups_verify_resend_limit": 2,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": null,
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "***********************************",
"smtp_from_name": "Vaultwarden xxx",
"smtp_host": "**************",
"smtp_password": "***",
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": "***********************",
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": 86,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}Vaultwarden Build Version1.33.2 Deployment methodOfficial Container Image Custom deployment methodNo response Reverse Proxytraefik 3.3.3 Host/Server Operating SystemLinux Operating System VersionLinux, Windows, ClientsBrowser Extension Client VersionFirefox 135.0 Steps To ReproduceDear VW team, Login on Firefox extension on any OS fails with "unexpected error". Desktop client works fine. This is the case for multiple weeks, but i didn't have time to investigate yet. Steps:
I do not get as far as being prompted for 2FA. Expected ResultReaching 2FA prompt, then successfully logged in Actual ResultUnexpected error after entering Master password LogsScreenshots or VideosExtension logs in FF debugging console: Additional ContextSo the client sends an apparently empty or broken /connect/token request and the server returns 400 with "no 2FA token provided". In addition, i get an email "Incomplete Two-Step Login from Firefox" - but it happens within milliseconds. Logging in to bitwarden.com from FF extension works fine. For comparison, the vaultwarden server log for a successful login from the Bitwarden Linux Desktop Client (2025.1.4): |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 14 replies
-
|
It works fine for me. I tried both the current store version v2024.12.4 and the latest build v2025.1.3. Could you try a clean Firefox profile and see what happens? |
Beta Was this translation helpful? Give feedback.
-
|
thats where i got the client log screenshot above, where the request data is not logged: |
Beta Was this translation helpful? Give feedback.
-
|
I do not know what the issue is then. There should be something in request if you are sending something.
|
Beta Was this translation helpful? Give feedback.
-
|
I get the same error now on every device i am trying to initially log in - even the Web UI, same error. I guess i have to use the admin interface to firstly remove all my 2FA factors - something seriously broke here. |
Beta Was this translation helpful? Give feedback.
-
|
that indeed solved it - i had both an Authenticator app and two yubikeys registered as 2FA for my user account. Removed all 2FA via admin interface, i can log in again. |
Beta Was this translation helpful? Give feedback.
-
|
Then I think something in between your server and client manipulates the response maybe? |
Beta Was this translation helpful? Give feedback.
-
|
nope...when at home, dns resolves domain directly to 192.168. Traefik has no middlewares for VW. I re-registered the same 2FA devices now (1x TOTP, 2x FIDO) and it works. |
Beta Was this translation helpful? Give feedback.
-
|
@BlackDex I had the error again, on ALL clients - web, desktop, extension. Under the premise that it is a fresh setup. |
Beta Was this translation helpful? Give feedback.
-
|
With fido you mean actual fido, or webauthn? What do the logs report? |
Beta Was this translation helpful? Give feedback.
-
|
sorry, webauthn. where you press the yubikey button and may or may not have a device pin on it. The logs are in my original post. The behavior is described, only that it is actually ANY client that you never logged in with before |
Beta Was this translation helpful? Give feedback.
-
|
this is from the webpage login: it gets worse, i now have only TOTP registered... |
Beta Was this translation helpful? Give feedback.
-
|
so 2fa essentially broke completely. This started an unknown number of weeks ago, but i guess at most December... is it possible to downgrade the server, keeping the data, to do git bisect? |
Beta Was this translation helpful? Give feedback.
-
|
It works just fine for me. It would be helpful if you get the responses of the client/extension in FireFox. But, if you use the Bitwarden sidebar (alt+shift+u), the debugging will show the output. |
Beta Was this translation helpful? Give feedback.
-
|
here is at the request body going through the webpage, extension is identical: |
Beta Was this translation helpful? Give feedback.
-
|
Looks perfectly normal. exactly as it should look like. This is my response, and i have configured all possible 2FA options for this account. {
"MasterPasswordPolicy": {
"Object": "masterPasswordPolicy"
},
"TwoFactorProviders": [
"0",
"2",
"3",
"7"
],
"TwoFactorProviders2": {
"0": null,
"2": {
"AuthUrl": "https://api-xxxxxxxx.duosecurity.com/oauth/v1/authorize?response_type=code&client_id=xxxxxxxxxx"
},
"3": {
"Nfc": true
},
"7": {
"allowCredentials": [
{
"id": "xxxxxxxxxxxxxxxxxxxxxxx",
"type": "public-key"
},
{
"id": "yyyyyyyyyyyyyyyyyyyyyyy",
"type": "public-key"
}
],
"challenge": "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz",
"extensions": {
"appid": "https://vw.local/app-id.json",
"getCredBlob": false
},
"rpId": "vw.local",
"timeout": 60000,
"userVerification": "discouraged"
}
},
"error": "invalid_grant",
"error_description": "Two factor required."
} |
Beta Was this translation helpful? Give feedback.
that indeed solved it - i had both an Authenticator app and two yubikeys registered as 2FA for my user account. Removed all 2FA via admin interface, i can log in again.