[GH-ISSUE #2110] Windows 10 Desktop app FIDO2 Webauthn stuck on "Loading" #1158

New issue

Closed

opened 2026-03-03 02:06:43 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 02:06:43 +03:00

Owner

Originally created by @timespacedecay on GitHub (Nov 23, 2021).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2110

I’m on the testing build of VaultWarden.

When trying to use FIDO2 WebAuthn login on the Bitwarden desktop app on Windows 10, the app displays “Loading” and never progresses. The following occurs in the vaultwarden logs:

[2021-10-26 10:07:37.321][request][INFO] POST /api/accounts/prelogin
[2021-10-26 10:07:37.321][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK
[2021-10-26 10:07:37.358][request][INFO] POST /identity/connect/token
[2021-10-26 10:07:37.396][error][ERROR] 2FA token not provided
[2021-10-26 10:07:37.396][response][INFO] POST /identity/connect/token (login) => 400 Bad Request

The mobile apps and browser extensions work as expected with WebAuthn (including the browser extension for Firefox on the same PC as the Desktop app having this issue).

Vaultwarden is hosted on my server at home and only accessible on my local LAN. I followed the HAProxy for pfSense guide to set up the reverse proxy.

DOMAIN variable is set in Unraid Docker for VaultWarden. Domain is also set in admin panel. No trailing / on the domain (https://vault.mylocaldomain.com).

https://vault.mylocaldomain.com/webauthn-mobile-connector.html correctly resolves the WebAuthn image (which is suppose to appear in the desktop app).

I have removed all headers from pfSense HAProxy; same issue. I have tried to connect directly via IP:Port in the desktop app; same issue.

I looked at the official BitWarden GitHub and the desktop app seems to work as expected for them. This seems to be an issue specific to either VaultWarden or with pfSense/HAProxy maybe?

Originally created by @timespacedecay on GitHub (Nov 23, 2021). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2110 I’m on the testing build of VaultWarden. When trying to use FIDO2 WebAuthn login on the Bitwarden desktop app on Windows 10, the app displays “Loading” and never progresses. The following occurs in the vaultwarden logs: ``` [2021-10-26 10:07:37.321][request][INFO] POST /api/accounts/prelogin [2021-10-26 10:07:37.321][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK [2021-10-26 10:07:37.358][request][INFO] POST /identity/connect/token [2021-10-26 10:07:37.396][error][ERROR] 2FA token not provided [2021-10-26 10:07:37.396][response][INFO] POST /identity/connect/token (login) => 400 Bad Request ``` The mobile apps and browser extensions work as expected with WebAuthn (including the browser extension for Firefox on the same PC as the Desktop app having this issue). Vaultwarden is hosted on my server at home and only accessible on my local LAN. I followed the HAProxy for pfSense guide to set up the reverse proxy. DOMAIN variable is set in Unraid Docker for VaultWarden. Domain is also set in admin panel. No trailing / on the domain (https://vault.mylocaldomain.com). https://vault.mylocaldomain.com/webauthn-mobile-connector.html correctly resolves the WebAuthn image (which is suppose to appear in the desktop app). I have removed all headers from pfSense HAProxy; same issue. I have tried to connect directly via IP:Port in the desktop app; same issue. I looked at the official BitWarden GitHub and the desktop app seems to work as expected for them. This seems to be an issue specific to either VaultWarden or with pfSense/HAProxy maybe?

kerem closed this issue

2026-03-03 02:06:43 +03:00

kerem commented

2026-03-03 02:06:44 +03:00

Author

Owner

@BlackDex commented on GitHub (Nov 23, 2021):

Posting this multiple times on different locations isn't going to help you. https://vaultwarden.discourse.group/t/windows-10-desktop-app-and-webauthn-not-working-mobile-browser-extensions-work-fine/1230/3 is pointing to two specific headers which could be the issue. I suggest to double check this and also, provide the support string.

@BlackDex commented on GitHub (Nov 23, 2021): Posting this multiple times on different locations isn't going to help you. https://vaultwarden.discourse.group/t/windows-10-desktop-app-and-webauthn-not-working-mobile-browser-extensions-work-fine/1230/3 is pointing to two specific headers which could be the issue. I suggest to double check this and also, provide the support string.

kerem referenced this issue

2026-03-03 09:08:51 +03:00

[PR #1158] [MERGED] Add /api/accounts/verify-password endpoint #2901