Unable to Deauthorize sessions

[MButcho]

Subject of the issue

When I try to Deauthorize sessions, I receive following error:

The reason is I wanted to implement push notifications, which are not working

Deployment environment

• vaultwarden version :v1.30.0

• Install method: Docker image

• Clients used: web vault, desktop, iOS

• Reverse proxy and version: nginx version: nginx/1.18.0 (Ubuntu)

• Nginx config:

http {
    upstream vaultwarden-default {
    zone vaultwarden-default 64k;
    server 127.0.0.1:8088;
    keepalive 2;
  }
  
  upstream vaultwarden-ws {
    zone vaultwarden-ws 64k;
    server 127.0.0.1:3012;
    keepalive 2;
  }

  server {
    server_name some.domain.com;
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    
    client_max_body_size 128M;

    location / {
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_pass http://vaultwarden-default;
    }

    location /notifications/hub/negotiate {
      proxy_http_version 1.1;
      proxy_set_header "Connection" "";

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_pass http://vaultwarden-default;
    }

    location /notifications/hub {
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Forwarded $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_pass http://vaultwarden-ws;
    }

    # Optionally add extra authentication besides the ADMIN_TOKEN
    # Remove the comments below `#` and create the htpasswd_file to have it active
    #
    #location /admin {
    #  # See: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/
    #  auth_basic "Private";
    #  auth_basic_user_file /path/to/htpasswd_file;
    #
    #  proxy_http_version 1.1;
    #  proxy_set_header "Connection" "";
    #
    #  proxy_set_header Host $host;
    #  proxy_set_header X-Real-IP $remote_addr;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header X-Forwarded-Proto $scheme;
    #
    #  proxy_pass http://vaultwarden-default;
    #}
    
    listen 443 ssl; # managed by Certbot
    ...
  }

Steps to reproduce

Log into web account / Account Settings / My Account / Deauthorize sessions / Send Code

Expected behaviour

Send email to confirm sessions deauthorize

Actual behaviour

Error above

Troubleshooting data

Log:
[2023-11-06 20:21:16.316][request][INFO] POST /api/accounts/request-otp
[2023-11-06 20:21:16.316][response][INFO] 404 Not Found

[MButcho]

Other actions that require OTP have the same issue, like exporting vault

[BlackDex]

Seems this only gets triggered when using Login With Device i think when looking at the Bitwarden client code.

Can you confirm this?

[MButcho]

Correct, when using master password to log in, the export and deauthorize is possible

[BlackDex]

Great thanks!

[BlackDex]

Also, i would suggest to update your nginx config to not use port 3012 anymore, and remove those locations. Also, sending Connect: Upgrade all the time is probably not good.

Check the https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples for more details.

[BlackDex]

I'm able to reproduce this, so now to find the correct solution to fix this.

[BlackDex]

Ok, it looks like this needs SMTP to be enabled.
Without this, you can't export, deauthorize, and maybe more specific items, like purge vault etc..

With this feature a mail will be sent with a passcode which enables you to verify you are you when you used Login with device which was unlocked via either PIN or Biometrics.

[kqmaverick]

I have SMTP enabled and still see this error.

[BlackDex]

I have SMTP enabled and still see this error.

That is correct, since the endpoints which are called are not supported by Vaultwarden.

But there could be people who do not have SMTP enabled for which this could be an issue.

Only way they can bypass is to login without an other device.