[GH-ISSUE #3001] TOTP not working with some services #1440

New issue

Closed

opened 2026-03-03 02:09:12 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 02:09:12 +03:00

Owner

Originally created by @0xab3d on GitHub (Dec 16, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/3001

Subject of the issue

TOTP not working with some services such as sucuri.net

Deployment environment

vaultwarden version: 1.26

Install method: Docker
Clients used: web vault and Edge extension
Reverse proxy and version: Sucuri SaaS
MySQL/MariaDB or PostgreSQL version:
Other relevant details:

Steps to reproduce

Edit the Sucuri entry, try to add the TOTP seed, nothing happens. Once I click save, the Edge extension just logs out. Replicated this on the web as well.

Expected behaviour

TOTP seed starts providing the 6 digit codes.

Actual behaviour

The Edge extension and the web session logs out when I save the changes.

Troubleshooting data

Originally created by @0xab3d on GitHub (Dec 16, 2022). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/3001   ### Subject of the issue  TOTP not working with some services such as _sucuri.net_ ### Deployment environment     * vaultwarden version: 1.26  * Install method: Docker * Clients used:  web vault and Edge extension * Reverse proxy and version:  Sucuri SaaS * MySQL/MariaDB or PostgreSQL version:  * Other relevant details: ### Steps to reproduce  Edit the Sucuri entry, try to add the TOTP seed, nothing happens. Once I click save, the Edge extension just logs out. Replicated this on the web as well. ### Expected behaviour  TOTP seed starts providing the 6 digit codes. ### Actual behaviour  The Edge extension and the web session logs out when I save the changes. ### Troubleshooting data

kerem closed this issue

2026-03-03 02:09:13 +03:00

kerem commented

2026-03-03 02:09:13 +03:00

Author

Owner

@BlackDex commented on GitHub (Dec 16, 2022):

I'm not sure how Sucuri SaaS works. Does that add an extra layer of authentication, then that could be an issue.

@BlackDex commented on GitHub (Dec 16, 2022): I'm not sure how Sucuri SaaS works. Does that add an extra layer of authentication, then that could be an issue.

kerem commented

2026-03-03 02:09:13 +03:00

Author

Owner

@0xab3d commented on GitHub (Dec 16, 2022):

Hey, it is a reverse proxy (acting as WAF)

@0xab3d commented on GitHub (Dec 16, 2022): Hey, it is a reverse proxy (acting as WAF)

kerem commented

2026-03-03 02:09:14 +03:00

Author

Owner

@BlackDex commented on GitHub (Dec 16, 2022):

I think the WAF is removing some headers or other items, which breaks either the client or server.

Check the logs, maybe set the log-level to debug for some more info.

@BlackDex commented on GitHub (Dec 16, 2022): I think the WAF is removing some headers or other items, which breaks either the client or server. Check the logs, maybe set the log-level to debug for some more info.

kerem commented

2026-03-03 02:09:14 +03:00

Author

Owner

@0xab3d commented on GitHub (Dec 16, 2022):

You're totally right. I have checked the logs and turned out the WAF is blocking PUT methods..

@0xab3d commented on GitHub (Dec 16, 2022): You're totally right. I have checked the logs and turned out the WAF is blocking PUT methods..