2024.8 Beta app, unable to log in or sync #4870
Labels
question
Further information is requested, or question from user
Third party
Needs an update from the third party library
troubleshooting
There might be bug or it could be user error, more info needed
Comments
|
It works just fine for me. Edit: I tested all options, WebAuthn (USB/NFC/Passkey via Other Bitwarden App), Fido2, Duo, Email and TOTP. |
BlackDex
added
the
question
|
The only line from the log is: [2024-08-19 10:42:55.196][error][ERROR] 2FA token not provided Which seems pretty standard, as this appears when the 2FA screen pops up (before submitting) The exact error on the app is "An error has occurred. Invalid verification code" Once i attempt to log in, for example using yubi key and i get the above message i immediately get an email to say new device was logged in. To confirm, this is on a Pixel 8 pro running android 14 (latest security/play system update) and bitwarden app: Version 2024.8.0 com.x8bit.bitwarden.beta I'm running this side by side now with 2024.7.1 com.xbit.bitwaren which works as expected I also removed all 2FA from my account and the beta app signed in as expected. Added the 2FA again and same issue |
|
I suspect that your reverse proxy is catching the error and returns it's own version. The 2FA token not provided error contains a json which is used to provide all available 2FA options. As mentioned, it works fine for me, just tested all options a few minutes ago. |
|
I see, i've found the logs in caddy (which is setup as per the wiki) and looks like it's returning a 400: I've removed the url and changed ip's below: {
"level": "info",
"ts": 1724066098.393086,
"logger": "http.log.access.log0",
"msg": "handled request",
"request": {
"remote_ip": "172.71.00.00",
"remote_port": "61308",
"client_ip": "172.71.00.00",
"proto": "HTTP/2.0",
"method": "POST",
"host": "vw.xxx.uk",
"uri": "/identity/connect/token",
"headers": {
"Cf-Ray": [
"8b59b915bd498889-LHR"
],
"Cf-Ipcountry": [
"GB"
],
"Accept-Encoding": [
"gzip, br"
],
"Cf-Connecting-Ip": [
"94.196.000.000"
],
"Auth-Email": [
"ZXhhbXBsZUB2YXVsdHdhcmRlbi5kb21haW4udGxk"
],
"User-Agent": [
"Bitwarden_Mobile/2024.8.0 (Android 14; SDK 34; Model Pixel 8 Pro)"
],
"Bitwarden-Client-Version": [
"2024.8.0"
],
"Content-Type": [
"application/x-www-form-urlencoded"
],
"Content-Length": [
"352"
],
"X-Forwarded-Proto": [
"https"
],
"Cf-Visitor": [
"{\"scheme\":\"https\"}"
],
"Bitwarden-Client-Name": [
"mobile"
],
"Device-Type": [
"0"
],
"Cdn-Loop": [
"cloudflare"
],
"X-Forwarded-For": [
"94.196.000.000"
]
},
"tls": {
"resumed": false,
"version": 772,
"cipher_suite": 4865,
"proto": "h2",
"server_name": "vw.xxx.uk"
}
},
"bytes_read": 352,
"user_id": "",
"duration": 0.803423585,
"size": 348,
"status": 400,
"resp_headers": {
"Content-Security-Policy": [
"default-src 'self'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://* ; img-src 'self' data: https://haveibeenpwned.com ; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net ;"
],
"Cache-Control": [
"no-cache, no-store, max-age=0"
],
"X-Xss-Protection": [
"0"
],
"X-Frame-Options": [
"SAMEORIGIN"
],
"Referrer-Policy": [
"same-origin"
],
"X-Content-Type-Options": [
"nosniff"
],
"Server": [
"Caddy",
"Rocket"
],
"Alt-Svc": [
"h3=\":443\"; ma=2592000"
],
"Date": [
"Mon, 19 Aug 2024 11:14:58 GMT"
],
"Content-Type": [
"application/json"
],
"Content-Length": [
"348"
],
"Permissions-Policy": [
"accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()"
]
}
} |
|
A valid response to the client should look like below. Anything else will cause the clients to generate an error. HTTP: POST /identity/connect/token HTTP/1.1
Connection: close
Host: vaultwarden.domain.tld
X-Real-IP: 111.222.333.444
X-Forwarded-For: 111.222.333.444
X-Forwarded-Proto: https
Content-Length: 238
auth-email: ZXhhbXBsZUB2YXVsdHdhcmRlbi5kb21haW4udGxk
user-agent: Bitwarden_Mobile/2024.8.0 (Android 14; SDK 34; Model Android 14)
bitwarden-client-name: mobile
bitwarden-client-version: 2024.8.0
device-type: 0
content-type: application/x-www-form-urlencoded
accept-encoding: gzip
scope=api%20offline_access&client_id=mobile&username=example%40vaultwarden.tld&password=EncRypTedPasSw0Rd&deviceIdentifier=11111111-aaaa-2222-bbbb-333333333333&deviceName=Android%2014&deviceType=0&grant_type=password
HTTP/1.1 400 Bad Request
content-type: application/json
server: Rocket
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
x-xss-protection: 0
content-security-policy: default-src 'self'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://* ; img-src 'self' data: https://haveibeenpwned.com ; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net ;
cache-control: no-cache, no-store, max-age=0
date: Mon, 19 Aug 2024 12:35:40 GMTBody: {
"MasterPasswordPolicy": {
"Object": "masterPasswordPolicy"
},
"TwoFactorProviders": [
"0",
"1",
"2",
"3",
"7"
],
"TwoFactorProviders2": {
"0": null,
"1": {
"Email": "ex*****@vaultwarden.tld"
},
"2": {
"AuthUrl": "https://api-12345678.duosecurity.com/oauth/v1/authorize?response_type=code&client_id=xxxxx"
},
"3": {
"Nfc": true
},
"7": {
"allowCredentials": [
{
"id": "123456789abcdefghijklmnopqrstuvwxyz123456789abcdefghijklmnopqrstuvwxyz123456789abcdefg",
"type": "public-key"
},
{
"id": "abcdefghijklmn-1234567",
"type": "public-key"
}
],
"challenge": "abcdefghijklmnopqrstuvwxyz1234567890abcdefg",
"extensions": {
"appid": "https://vaultwarden.domain.tld/app-id.json",
"getCredBlob": false
},
"rpId": "vaultwarden.domain.tld",
"timeout": 60000,
"userVerification": "discouraged"
}
},
"error": "invalid_grant",
"error_description": "Two factor required."
} |
|
Also, i see you are using Cloudflare, it might be that something there changes the response. |
|
Here is the tcp flow result: POST /identity/connect/token HTTP/1.1
Host: vw.xxx.uk
User-Agent: Bitwarden_Mobile/2024.8.0 (Android 14; SDK 34; Model Pixel 8 Pro)
Content-Length: 352
Accept-Encoding: gzip, br
Auth-Email: xxx
Bitwarden-Client-Name: mobile
Bitwarden-Client-Version: 2024.8.0
Cdn-Loop: cloudflare
Cf-Connecting-Ip: 94.196.000.000
Cf-Ipcountry: GB
Cf-Ray: 8b5a6ef52f7079c5-LHR
Cf-Visitor: {"scheme":"https"}
Content-Type: application/x-www-form-urlencoded
Device-Type: 0
X-Forwarded-For: 172.69.000.000
X-Forwarded-Host: vw.xxx.uk
X-Forwarded-Proto: https
X-Real-Ip: 94.196.000.000
scope=api%20offline_access&client_id=mobile&username=myemail.co.uk&password=12345678%12345678%2FW8NbvI%2BNDVLh%2BY%3D&deviceIdentifier=1234567-7787-43b6-1234-13904bc6a1e7&deviceName=Pixel%208%20Pro&deviceType=0&grant_type=password&twoFactorToken=asdfghjkl&twoFactorProvider=3&twoFactorRemember=1
HTTP/1.1 400 Bad Request
content-type: application/json
server: Rocket
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
x-xss-protection: 0
content-security-policy: default-src 'self'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://* ; img-src 'self' data: https://haveibeenpwned.com ; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net ;
cache-control: no-cache, no-store, max-age=0
content-length: 348
date: Mon, 19 Aug 2024 13:19:07 GMT{"error":"","errorModel":{"message":"Failed to verify Yubikey against OTP server","object":"error"},"error_description":"","exceptionMessage":null,"exceptionStackTrace":null,"innerExceptionMessage":null,"message":"Failed to verify Yubikey against OTP server","object":"error","validationErrors":{"":["Failed to verify Yubikey against OTP server"]}} |
|
That specific error message looks like an issue with configuring the YubiKey settings. Lines 432 to 438 in 669b9db |
|
Or, your Vaultwarden is not able to connect to the Yubi Server. |
|
I've regenerated the yubi key, updated the confid and can log into my webvault with the new (as i could the old) but same issue on beta app. digagnostics all look green, here is the support string: Your environment (Generated via diagnostics page)
Config (Generated via diagnostics page)Show Running ConfigEnvironment settings which are overridden: {
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": true,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "cid:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_max_conns": 10,
"database_timeout": 30,
"database_url": "***************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"domain": "*****://************",
"domain_origin": "*****://************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "fido2-vault-credentials",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": true,
"ip_header": "X-Forwarded-For",
"job_poll_interval_ms": 30000,
"log_file": "/var/log/vaultwarden/vaultwarden.log",
"log_level": "warn",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"push_enabled": true,
"push_identity_uri": "https://identity.bitwarden.eu",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.eu",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": false,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": "\"Login\"",
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "*******************",
"smtp_from_name": "Vaultwarden (vw.xxx.uk)",
"smtp_host": "*********************",
"smtp_password": "***",
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": "*******************",
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": "xxx",
"yubico_secret_key": "***",
"yubico_server": null
} |
|
I've also run tcp flow with a authentication app key, as it fails on the app with the same message: |
|
same problem after update to 2024.8.0, except I cannot remove yubikey from 2FA. it shows |
|
@turnah small warning, you did disclosed your email address, vault domain etc.. by sharing the last post. |
|
@tyde7 Are you using Cloudflare as well? Also @turnah, the last post, if that really is what the client received, then it should have worked without any issue. Please try to use the debug version from here https://github.com/bitwarden/android/actions/runs/10291080138 EDIT: I updated the link to the exact same build as i have installed on my phone which is |
I spoiled/randomised all the tokens/keys/values; so hopefully OK! Really appreciate you doing that and your help. |
|
@turnah, nope, the JWT was still able to be decoded, though partially, but still useful info was in there. |
|
And, comparing the outputs, they do match exactly what i see during my tests. So the output of Vaultwarden should be valid, and something unsupported is being received by the client in some strange way. So, we would need to see what the client receives, which is (if i remember correctly) doable via the |
|
Lesson learned... hopefully this one is better using logcat and the -qa version linked |
|
Strange, that output looks as it should. Are there any errors or warnings in that same output with a reason why it failed?? |
|
I've run it again, this time using my local instance of vaultwarden (internal caddy that uses hosts on my router) so this doesn't use cloudflare to take that out of the equation. Her are the 2 seconds of logs |
|
I have the exact same issue like you. I can reproduce the error on a public vaultwarden server vault.pwbox.de Desktop app Windows and Linux and browser apps work fine with 2FA |
|
The same error here. Just tried the new beta app. I'm using DUO |
|
Very strange. I'm just unable to reproduce this on my environment at all. The responses all look ok as far as i can see. It is going to be very hard to fix this without me being able to reproduce this with an environment i can control. |
Just updated to the latest version and its working now :O. (Didn't knew there was a new version :-) |
|
@ManuVice, I am unable to reproduce this via pwbox either using Bitwarden Mobile Beta. |
|
Thank you 👍 I will debug my phone and post information if I find something. |
BlackDex
added
the
troubleshooting
|
I have tried another phone. With 2024.7.1 2FA is working fine, 2024.8 (18985) same error on my own vault and at pwbox. I have create a logcat, but I think its not a problem of Vaultwarden Logcat |
|
@ManuVice, I'm not seeing any output from the Bitwarden app. That will only happen when using the |
|
Do you mean something like Authentik? No, I dont use something like that |
|
After removing |
|
Appreciate your help with this one - testing tag has fixed for me |
|
The |
|
Thank you for fixing this issue. Do you have an idea when this change would be released? If its a while away or unknown, is the recommended approach to use the testing image that was generated today? |
|
I hope this fix is enough. If so releasing a new version shouldn't be that far away. |
|
Hi @halms, this is teally strange, I'm on the |
Sounds like it’s a different issue then. Can you provide more details of your setup? Details of your entries etc to find the “what else” could be leading to the issues. |
|
@Gerardv514 Nevermind, I don't know how but after using the I don't know if the |
|
Are you sure you were on testing? Meaning you physically confirmed via admin/diagnostic page and saw the testing version number? |
|
@Gerardv514 Yes, I've completely rebuilt the container after changing the version on my compose file. |
|
I just don't get it anymore. I'm self-hosted on vaultwarden 1.32.0. Cannot make Bitwarden iOS Apps work on iOS18 ("an error occurred"). Webvault, windows clients, browser extensions and MacOS Sonoma all are still working -- YET i just tried logging into several website using Passkey on my iOS18 devices and to my surprise it worked like it always has (even though I'm not even logged in with Bitwarden, but the Passkey-Pop up just works. Does that make sense? For me it doesnt |
What is your iOS client app version? |
Latest version that came out 3 days ago: 2024.9.2 |
Unfortunately, this doesn't appear to be working for me. I only had one password that was null, which was deleted from the vault and the trash bin. I'll work later on updating the Vaultwarden image I'm using, but the iOS apps I'm using are 2024.9.2 (1106) from an iPad (18.0) and an iPhone (18.0). |
|
Use |
|
Finally got around to Any word on when the fix will be rolled into released versions? |
|
1.32.1 was just released yesterday. |
|
I'm still having problems with the iOS app. I did have some null passwords, but not in the passwordHistory. I have changed all of them - one was in the thrash, so I permanently deleted it, and now the export does not have any passwords with null in them. I uninstalled and installed the iOS app, but this did not help. I saw that I have some organizational passwords, which I have exported through the Vaultwarden-Web and they also don't have null passwords. So I'm not sure what's going on and what I could do in order to resolve the issue. And yes I have the newest container, so the fix didn't work for me. And Importing the export in my Bitwarden account worked without errors |
|
@gergan If you want to help, please follow the instructions in the comment here (and the comment after that) #4870 (comment) |
|
I'll look how to export it later. It seems the problem is not the sync or the log-in, the app works just normally (it suggest and supplies passwords in Safari for example), but shows the error on the view-screen (where all the entries should be shown). Sync works just ok, It shows the folders in settings and so on. So it is some dumb validation or something like that, which hinders it to show its main screen. |
|
Also @gergan items with |
Maybe you can share a screenshot on what you mean? Because I'm not really following what the current issue then is. |
You should also post a new issue since this thread is for sync and log in issues. In the new thread you need to provide more information and logs, and not just saying I’m having the same problem. There could be something totally different going on than what was addressed here and therefore on the technical side is not the same problem. |
|
I'll create a new one probably in the evening - but just to show what I mean. Here are some screenshots, for the problem I have. The App could sync, work generally - but the search and the main view show this error |
|
That could have everything to do with the sync which is returned, or maybe not, but what Vaultwarden returns, is what the client needs to parse and decrypt. If there is anything wrong or strange with the response, then this might be a result of this. |
|
Hi Guys - just telling - since I've updated the vaultwarden-docker-container to 1.32.1 the issue disappeared |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
and others
Subject of the issue
Unable to sign into bitwarden app using version 2024.8.0 (beta) on android with 2FA.
Can confirm the webvault works as expected. no issues.
Attempted Yubikey, authenticator app code and email. Each one comes up with an error unable to validate.
Left the beta programme on android and rolled back to 2024.7.1 and all worked as expected.
Logging as a bug in case this is a breaking change on the android app - apologies if should be a discussion
Deployment environment
vaultwarden version: 1.32.0
Install method: docker
Clients used: android, webvault
Reverse proxy and version: caddy
Other relevant details:
Steps to reproduce
Join android beta, install 2024.8.0 and try to sign in (self hosted)
Expected behaviour
2FA validates
Actual behaviour
2FA unable to validate
The text was updated successfully, but these errors were encountered: