mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-26 09:46:00 +03:00
[GH-ISSUE #5109] KDF values shown wrong in webvault, also warning popup is wrong (2 problems) #2074
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#2074
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @rdslw on GitHub (Oct 19, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5109
Vaultwarden Build Version
v1.32.2
Deployment method
Other method
Custom deployment method
personalized docker container
Reverse Proxy
none
Host/Server Operating System
Linux
Clients
Web Vault
Client Version
firefox 131.0.3
Steps To Reproduce
Expected Result
Actual Result
sqlite> select email,password_iterations from users;
x1@x1|100000
x2@x2|700007
x3@x3|700007
Above steps used login x2.
Login x3 also shows bug no 2 (wrong value upon type switching), while there was popup, but was dismissed and does not appear again, ALTHOUGH kdf was not changed.
I'm not sure in which version it happenes.
Logs
No response
Screenshots or Videos
No response
Additional Context
No response
@BlackDex commented on GitHub (Oct 19, 2024):
Not sure what we can do here. Vaultwarden stores what it receives.
I find the steps a bit strange but will try to reproduce it.
Are you sure you didn't mixed and the Vaultwarden KDF settings with the account KDF settings? Those are two totally different items.
@rdslw commented on GitHub (Oct 19, 2024):
Thanks for fast reply.
as to reproducability: problem no2 (webvault shows different values just on clicking PKDF2 vs argon type) shall be easy to reproduce, as it happens on newest v1.32.2. Can provide short video here if interested to see it.
As to the problem no1 (different value in sqlite users table vs what webvault shows) and popup warning -> I'm not sure when it started, probably earlier. while on v1.3?.*
I understand that users table, and webavult (settings -> security -> keys) both shows account KDF settings. Am I correct?
where can I check/see Vaultwarden KDF settings? config.json + /admin ?
@BlackDex commented on GitHub (Oct 19, 2024):
Also the kdf can't change without user interaction. Else you wouldn't be able to login again anymore.
@BlackDex commented on GitHub (Oct 19, 2024):
The Vaultwarden kdf is visible in the admin settings
@rdslw commented on GitHub (Oct 19, 2024):
ok, so what I'm seeing is relevant to the account KDF settings.
To summarize:
problem 1: popup shows, even if KDF settings (as verified in sqlite) are 700007
problem 2: values shown for KDF settings are wrong (settings -> security -> keys)
a. I have 700007 as sqlite shows
b. go to the settings>security>keys: I see there 100000 as current KDF
c. while being there, change PBKDF2 to argontype, and back (NB: just clicking, no clicking 'change kdf' button.
d. KDF shows 600000 (vaultwarden default)
@BlackDex commented on GitHub (Oct 19, 2024):
Again, which column are you looking at? Since I am not able to reproduce this at all using the steps you mentioned.
I have done the following.
For the database i used this query:
docker run -it -e DISABLE_ADMIN_TOKEN=true -v "${PWD}/tmp:/data" -p8080:80 docker.io/bitwardenrs/server:1.20.0docker run -it -e DISABLE_ADMIN_TOKEN=true -v "${PWD}/tmp:/data" -p8080:80 ghcr.io/dani-garcia/vaultwarden:1.32.2Database results:
I Did the same but then started from v1.29.2 which is the last v1.2* verison.
docker run -it -e DISABLE_ADMIN_TOKEN=true -v "${PWD}/tmp:/data" -p8080:80 ghcr.io/dani-garcia/vaultwarden:1.29.2docker run -it -e DISABLE_ADMIN_TOKEN=true -v "${PWD}/tmp:/data" -p8080:80 ghcr.io/dani-garcia/vaultwarden:1.32.2Database results:
@rdslw commented on GitHub (Oct 19, 2024):
I was originally looking at passwords_iterations column.
Here is result of your query run now.
sqlite> SELECT uuid, password_iterations, client_kdf_type, client_kdf_iter, client_kdf_memory, client_kdf_parallelism FROM users
...> ;
X1..e3|100000|0|100000||
X2..12|700007|0|900009||
X3..e4|700007|0|100000||
Looks like problem no1 was my mistake of X2 vs X3 user, which with problem no2 make me no trusting values shown. sorry for that.
shall probably change issue title to "KDF values shown wrong in webavult upon selecting different algo type"
Looks like only problem 2 exists, on both users (X2 and X3).
How to reproduce:
use current version v1.32.2
login to webavaul
go to settings/security/keys, see:
switch algorithm type to argon, DO NOT click button 'change kdf', see:
switch again algorithm type to PBKDF2, see wrong iterations:
problem no2 visible here: iterations is now 600000 while was 100000 on step 3. User iterations is 100000.
@BlackDex commented on GitHub (Oct 19, 2024):
Well, that seems like a UI client issue, and it shows the default recommend value. If you do not click on save then it will still be 100_000 unless you save of course.
As this is a web-vault/client issue, and this project does not maintain or develop those, it's not something we can fix (easily).
If anything, I would suggest to check and verify if this also happens on the Bitwarden Cloud environment, if so, report this in there client repo on GitHub. Else it might be fixed already in a version newer than v2024.6.2, which Vaultwarden does not (yet) support.
As this is a client issue, I'm going to move this to a discussion.