[GH-ISSUE #5237] Android bitwarden app stopped having access to vault #2103

Closed
opened 2026-03-03 02:15:19 +03:00 by kerem · 32 comments
Owner

Originally created by @diagpope on GitHub (Nov 27, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5237

Vaultwarden Support String

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.32.5
  • Web-vault version: v2024.6.2c
  • OS/Arch: linux/x86_64
  • Running within a container: true (Base: Debian)
  • Environment settings overridden: false
  • Uses a reverse proxy: true
  • IP Header check: true (X-Real-IP)
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: true
  • Domain Configuration Check: false
  • HTTPS Check: false
  • Database type: SQLite
  • Database version: 3.46.0
  • Clients used:
  • Reverse proxy and version:
  • Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "cid:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "****://*********",
  "domain_origin": "****://*********",
  "domain_path": "",
  "domain_set": false,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "fido2-vault-credentials",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": false,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": "data/vw.log",
  "log_level": "warn",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": null,
  "smtp_password": null,
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": null,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": "'removed'",
  "yubico_secret_key": "***",
  "yubico_server": null
}

Vaultwarden Build Version

Version 2024.6.2

Deployment method

Official Container Image

Custom deployment method

No: Plain docker-compose, caddy, fail2ban

Reverse Proxy

image: caddy:2

Host/Server Operating System

Linux

Operating System Version

Ubuntu 22.04.5 LTS

Clients

Android

Client Version

latest bitwarden

Steps To Reproduce

  1. Open Bitwarden
  2. Enter passcode
  3. or log out and Enter Masterpassword

Expected Result

Successful login

Actual Result

We were unable to process your request. Please try again or contact us.

Logs

I have not managed enabling logging yet. I am sure that I will need get logging enabled to get some helpful insight.

Screenshots or Videos

I can log into the vault from any other OS, web browser and extension.
This problem existed a few months ago and disappeared (reboot phone)
This time I signed up for bitwarden beta which has no newer release and also tried uninstall and reinstall

Additional Context

It seems that I am logged in as I can change settings but there is no vault access.

Originally created by @diagpope on GitHub (Nov 27, 2024). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5237 ### Vaultwarden Support String ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.32.5 * Web-vault version: v2024.6.2c * OS/Arch: linux/x86_64 * Running within a container: true (Base: Debian) * Environment settings overridden: false * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: false * HTTPS Check: false * Database type: SQLite * Database version: 3.46.0 * Clients used: * Reverse proxy and version: * Other relevant information: ### Config (Generated via diagnostics page) <details><summary>Show Running Config</summary> **Environment settings which are overridden:** ```json { "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "cid:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_max_conns": 10, "database_timeout": 30, "database_url": "***************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "****://*********", "domain_origin": "****://*********", "domain_path": "", "domain_set": false, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "fido2-vault-credentials", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": false, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": "data/vw.log", "log_level": "warn", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "", "smtp_from_name": "Vaultwarden", "smtp_host": null, "smtp_password": null, "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": null, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": "'removed'", "yubico_secret_key": "***", "yubico_server": null } ``` </details> ### Vaultwarden Build Version Version 2024.6.2 ### Deployment method Official Container Image ### Custom deployment method No: Plain docker-compose, caddy, fail2ban ### Reverse Proxy image: caddy:2 ### Host/Server Operating System Linux ### Operating System Version Ubuntu 22.04.5 LTS ### Clients Android ### Client Version latest bitwarden ### Steps To Reproduce 1. Open Bitwarden 2. Enter passcode 3. or log out and Enter Masterpassword ### Expected Result Successful login ### Actual Result We were unable to process your request. Please try again or contact us. ### Logs ```text I have not managed enabling logging yet. I am sure that I will need get logging enabled to get some helpful insight. ``` ### Screenshots or Videos I can log into the vault from any other OS, web browser and extension. This problem existed a few months ago and disappeared (reboot phone) This time I signed up for bitwarden beta which has no newer release and also tried uninstall and reinstall ### Additional Context It seems that I am logged in as I can change settings but there is no vault access.
kerem 2026-03-03 02:15:19 +03:00
  • closed this issue
  • added the
    bug
    label
Author
Owner

@BlackDex commented on GitHub (Nov 27, 2024):

For some strange reason still unknown, some users have issues like this. Unfortunately nobody is able to figure out what the exact issue is.

You might want to try the following steps described here.
https://github.com/dani-garcia/vaultwarden/discussions/5152#discussioncomment-11146453

But first make sure you have a backup of your database and data finder!

<!-- gh-comment-id:2503240973 --> @BlackDex commented on GitHub (Nov 27, 2024): For some strange reason still unknown, some users have issues like this. Unfortunately nobody is able to figure out what the exact issue is. You might want to try the following steps described here. https://github.com/dani-garcia/vaultwarden/discussions/5152#discussioncomment-11146453 But first make sure you have a backup of your database and data finder!
Author
Owner

@diagpope commented on GitHub (Nov 27, 2024):

@BlackDex
Thanks for the link.
I changed the masterpassword with "rotate my account's encryption key" - no fix
I also changed the KBF - no fix
clear storage, clear cache, uninstall Android's bitwarden - no fix
Now it does not accept the 6 digit verification code or the recovery code
Even disabling the 2FA on the web still makes the android app ask fro 2FA .. therefore
uninstalled again - logged in w/o 2FA but vault is still inaccessible

How do I see potential problems on the instance. Is the proxy log the only one or should vaulwarden itself also produce log files? I read on some posts that users look at cipher exchange between client and instance

<!-- gh-comment-id:2504571056 --> @diagpope commented on GitHub (Nov 27, 2024): @BlackDex Thanks for the link. I changed the masterpassword with "rotate my account's encryption key" - no fix I also changed the KBF - no fix clear storage, clear cache, uninstall Android's bitwarden - no fix Now it does not accept the 6 digit verification code or the recovery code Even disabling the 2FA on the web still makes the android app ask fro 2FA .. therefore uninstalled again - logged in w/o 2FA but vault is still inaccessible How do I see potential problems on the instance. Is the proxy log the only one or should vaulwarden itself also produce log files? I read on some posts that users look at cipher exchange between client and instance
Author
Owner

@mindonwarp commented on GitHub (Nov 27, 2024):

I've been having this issue as well. I first noticed it a month ago and ignored it until I couldn't even use the autofill option anymore.

I updated my vaultwarden docker image to the latest version at that time a few weeks ago (can't remember which version it was) and the android app worked again.

I have watchtower running and it recently updated the vaultwarden image and now the android app is not working again. Maybe the version is somehow important?

I'll revert my vaultwarden image back to an earlier version in hopes it will help, and disable watchtower monitoring for the container.

<!-- gh-comment-id:2504576517 --> @mindonwarp commented on GitHub (Nov 27, 2024): I've been having this issue as well. I first noticed it a month ago and ignored it until I couldn't even use the autofill option anymore. I updated my vaultwarden docker image to the latest version at that time a few weeks ago (can't remember which version it was) and the android app worked again. I have watchtower running and it recently updated the vaultwarden image and now the android app is not working again. Maybe the version is somehow important? I'll revert my vaultwarden image back to an earlier version in hopes it will help, and disable watchtower monitoring for the container.
Author
Owner

@BlackDex commented on GitHub (Nov 27, 2024):

I would not recommend to revert to an older version. Mainly because of security bugs. Also the latest version should have better fixes for the new native clients and sound work better.

If it doesn't work, I would need more info.
See https://github.com/dani-garcia/vaultwarden/issues/4870#issuecomment-2306749481 on how to extract these details for me.

<!-- gh-comment-id:2504914303 --> @BlackDex commented on GitHub (Nov 27, 2024): I would not recommend to revert to an older version. Mainly because of security bugs. Also the latest version should have better fixes for the new native clients and sound work better. If it doesn't work, I would need more info. See https://github.com/dani-garcia/vaultwarden/issues/4870#issuecomment-2306749481 on how to extract these details for me.
Author
Owner

@diagpope commented on GitHub (Nov 27, 2024):

This is the version from the Google Play store that did not work

User-Agent: Bitwarden_Mobile/2024.11.6 (release/standard) (Android 11; SDK 30; Model motorola one 5G ace)^M

The log file produced with sudo tcpflow -i any -C port 80 on the failed access is
tcpflow.broken.gz

Then I installed from https://github.com/bitwarden/mobile/releases this version:
Version 2024.7.1

Access to the vault was restored. log file produced with sudo tcpflow -i any -C port 80 on the successful access is
tcpflow.success.gz

How can I self diagnose this next time?

<!-- gh-comment-id:2504983574 --> @diagpope commented on GitHub (Nov 27, 2024): This is the version from the Google Play store that did not work ``` User-Agent: Bitwarden_Mobile/2024.11.6 (release/standard) (Android 11; SDK 30; Model motorola one 5G ace)^M ``` The log file produced with `sudo tcpflow -i any -C port 80` on the failed access is [tcpflow.broken.gz](https://github.com/user-attachments/files/17941109/tcpflow.broken.gz) Then I installed from https://github.com/bitwarden/mobile/releases this version: [Version 2024.7.1](https://github.com/bitwarden/mobile/releases/tag/v2024.7.1) Access to the vault was restored. log file produced with `sudo tcpflow -i any -C port 80` on the successful access is [tcpflow.success.gz](https://github.com/user-attachments/files/17941112/tcpflow.success.gz) How can I self diagnose this next time?
Author
Owner

@mindonwarp commented on GitHub (Nov 28, 2024):

The configuration that is now working for me:

  • Vaultwarden version 1.32.5
  • Proxy: jc21/nginx-proxy-manager:2
  • Bitwarden App: 2024.11.5 (19461)
<!-- gh-comment-id:2505212285 --> @mindonwarp commented on GitHub (Nov 28, 2024): The configuration that is now working for me: - Vaultwarden version 1.32.5 - Proxy: jc21/nginx-proxy-manager:2 - Bitwarden App: 2024.11.5 (19461)
Author
Owner

@BlackDex commented on GitHub (Nov 28, 2024):

@dombrowa the version you are using now is not the native client.
Those can be found at the bitwarden/android repo not the bitwarden/mobile.

I'll have to shift through the data and see if i can give anything which might break the client. But that isn't going to be easy.

Something in te response of the server, most likely the sync request is sending something the native clients do not support our crash on. What this is exactly isn't easy to tell. Since I'm not able to reproduce this my self.

<!-- gh-comment-id:2505474327 --> @BlackDex commented on GitHub (Nov 28, 2024): @dombrowa the version you are using now is not the native client. Those can be found at the `bitwarden/android` repo not the `bitwarden/mobile`. I'll have to shift through the data and see if i can give anything which might break the client. But that isn't going to be easy. Something in te response of the server, most likely the sync request is sending something the native clients do not support our crash on. What this is exactly isn't easy to tell. Since I'm not able to reproduce this my self.
Author
Owner

@BlackDex commented on GitHub (Nov 28, 2024):

@dombrowa Unfortunately those tcpflows are not useful for me.
I think you tried to remove some sensitive data, which mangled the whole json. If I'm not able to see the json in it's original form i can't try to debug this. It will take me to much time, and i can't tell if there is something wrong with Vaultwarden, or if it is something deleted/mangled by you.

<!-- gh-comment-id:2505848191 --> @BlackDex commented on GitHub (Nov 28, 2024): @dombrowa Unfortunately those tcpflows are not useful for me. I think you tried to remove some sensitive data, which mangled the whole json. If I'm not able to see the json in it's original form i can't try to debug this. It will take me to much time, and i can't tell if there is something wrong with Vaultwarden, or if it is something deleted/mangled by you.
Author
Owner

@diamondtipdr commented on GitHub (Nov 28, 2024):

I tried the android Bitwarden native app (as part of the beta in the Play Store), and it didn't like my VW instance. Had to change back to the standard version available in the Store (2024.10.0 11270) for it to work.

<!-- gh-comment-id:2506482341 --> @diamondtipdr commented on GitHub (Nov 28, 2024): I tried the android Bitwarden native app (as part of the beta in the Play Store), and it didn't like my VW instance. Had to change back to the standard version available in the Store (2024.10.0 11270) for it to work.
Author
Owner

@diagpope commented on GitHub (Nov 29, 2024):

@BlackDex
The command I used to capture was:

sudo tcpflow -i any -C port 80 | tee ~/tcpflow.xxx

Then, I only used sed commands to redact text as such:

sed -i 's/<before>/redacteddomain/g' $@

Is there a better way to capture traces?

When I look at the log files, they seem to contain mostly HTTP headers that are not json, and only a few lines of json that can be parsed via jq (example below)

echo '{"environment":{"api":"http://localhost/api","identity":"http://localhost/identity","notifications":"http://localhost/notifications","sso":"","vault":"http://localhost"},"featureStates":{"fido2-vault-credentials":true,"flexible-collections-v-1":false,"key-rotation-improvements":true},"gitHash":"cdfdc6ff","object":"config","server":{"name":"Vaultwarden","url":"https://github.com/dani-garcia/vaultwarden"},"settings":{"disableUserRegistration":true},"version":"2024.2.0"}' | jq .
{
  "environment": {
    "api": "http://localhost/api",
    "identity": "http://localhost/identity",
    "notifications": "http://localhost/notifications",
    "sso": "",
    "vault": "http://localhost"
  },
  "featureStates": {
    "fido2-vault-credentials": true,
    "flexible-collections-v-1": false,
    "key-rotation-improvements": true
  },
  "gitHash": "cdfdc6ff",
  "object": "config",
  "server": {
    "name": "Vaultwarden",
    "url": "https://github.com/dani-garcia/vaultwarden"
  },
  "settings": {
    "disableUserRegistration": true
  },
  "version": "2024.2.0"
}
<!-- gh-comment-id:2507019953 --> @diagpope commented on GitHub (Nov 29, 2024): @BlackDex The command I used to capture was: ``` sudo tcpflow -i any -C port 80 | tee ~/tcpflow.xxx ``` Then, I only used sed commands to redact text as such: ``` sed -i 's/<before>/redacteddomain/g' $@ ``` Is there a better way to capture traces? When I look at the log files, they seem to contain mostly HTTP headers that are not json, and only a few lines of json that can be parsed via jq (example below) ``` echo '{"environment":{"api":"http://localhost/api","identity":"http://localhost/identity","notifications":"http://localhost/notifications","sso":"","vault":"http://localhost"},"featureStates":{"fido2-vault-credentials":true,"flexible-collections-v-1":false,"key-rotation-improvements":true},"gitHash":"cdfdc6ff","object":"config","server":{"name":"Vaultwarden","url":"https://github.com/dani-garcia/vaultwarden"},"settings":{"disableUserRegistration":true},"version":"2024.2.0"}' | jq . { "environment": { "api": "http://localhost/api", "identity": "http://localhost/identity", "notifications": "http://localhost/notifications", "sso": "", "vault": "http://localhost" }, "featureStates": { "fido2-vault-credentials": true, "flexible-collections-v-1": false, "key-rotation-improvements": true }, "gitHash": "cdfdc6ff", "object": "config", "server": { "name": "Vaultwarden", "url": "https://github.com/dani-garcia/vaultwarden" }, "settings": { "disableUserRegistration": true }, "version": "2024.2.0" } ```
Author
Owner

@diagpope commented on GitHub (Nov 29, 2024):

The configuration that is now working for me:

  • Vaultwarden version 1.32.5
  • Proxy: jc21/nginx-proxy-manager:2
  • Bitwarden App: 2024.11.5 (19461)

Interesting, when I ran

  • Vaultwarden version 1.32.5, image: vaultwarden/server:latest
  • Proxy: image: caddy:2
  • Bitwarden App: 2024.11.6

I encountered the failure.
Either the android client or the combination of android client and proxy caused the problem on android mobile.
It seemed to work in iOS which I do not use.

<!-- gh-comment-id:2507029951 --> @diagpope commented on GitHub (Nov 29, 2024): > The configuration that is now working for me: > > * Vaultwarden version 1.32.5 > * Proxy: jc21/nginx-proxy-manager:2 > * Bitwarden App: 2024.11.5 (19461) Interesting, when I ran * Vaultwarden version 1.32.5, image: vaultwarden/server:latest * Proxy: image: caddy:2 * Bitwarden App: 2024.11.6 I encountered the failure. Either the android client or the combination of android client and proxy caused the problem on android mobile. It seemed to work in iOS which I do not use.
Author
Owner

@BlackDex commented on GitHub (Nov 29, 2024):

The only issue i know of regarding reverse proxies is if they do some security filtering, or override headers.

@dombrowa well, that redaction caused the output to be not useable for me.

The other way would be generating the har file via the browser just on your desktop. There sync output should be exactly the same, so that will be fine. But i would not suggest to put that har file here.
Use the contact options i suggested in the link.

<!-- gh-comment-id:2507297950 --> @BlackDex commented on GitHub (Nov 29, 2024): The only issue i know of regarding reverse proxies is if they do some security filtering, or override headers. @dombrowa well, that redaction caused the output to be not useable for me. The other way would be generating the *har* file via the browser just on your desktop. There sync output should be exactly the same, so that will be fine. But i would not suggest to put that har file here. Use the contact options i suggested in the link.
Author
Owner

@diagpope commented on GitHub (Dec 3, 2024):

@BlackDex
Question: If I use my browser on the desktop, I do not encounter the login failure to vaultwarden.
How to I get an har file when using the bitwarden mobile app?

When I run this, I see the not redacted output is not recognized json either:

sudo tcpflow -i any -C port 80 |tee bitwarden.tcpflow.fail | jq .
reportfilename: ./report.xml
tcpflow: listening on any
parse error: Invalid numeric literal at line 1, column 4


Note: I just updated the mobile app on android and am seeing the login failure again.
<!-- gh-comment-id:2513229690 --> @diagpope commented on GitHub (Dec 3, 2024): @BlackDex Question: If I use my browser on the desktop, I do not encounter the login failure to vaultwarden. How to I get an har file when using the bitwarden mobile app? When I run this, I see the not redacted output is not recognized json either: ``` sudo tcpflow -i any -C port 80 |tee bitwarden.tcpflow.fail | jq . reportfilename: ./report.xml tcpflow: listening on any parse error: Invalid numeric literal at line 1, column 4 Note: I just updated the mobile app on android and am seeing the login failure again.
Author
Owner

@diagpope commented on GitHub (Dec 3, 2024):

I tried the following versions from https://github.com/bitwarden/android

11.4 
11.0
10.2
9.0 beta
8.1 beta
7.3 beta
7.2
7.1 beta  - which I assumed to be close to the mobile 7.1 below, but ...

only this one below works for my android 11 OS. It is not from the android page but
https://github.com/bitwarden/mobile

Version 2024.7.1.apk
<!-- gh-comment-id:2513319282 --> @diagpope commented on GitHub (Dec 3, 2024): I tried the following versions from https://github.com/bitwarden/android ``` 11.4 11.0 10.2 9.0 beta 8.1 beta 7.3 beta 7.2 7.1 beta - which I assumed to be close to the mobile 7.1 below, but ... ``` only this one below works for my android 11 OS. It is not from the android page but https://github.com/bitwarden/mobile ``` Version 2024.7.1.apk ```
Author
Owner

@BlackDex commented on GitHub (Dec 3, 2024):

As mentioned before, everything in /mobile is not the native app.
Only applications in /ios or /android are the native apps.

It doesn't matter if the error occurs or not on your browser, i need the har file which includes an unmodified response of the sync request done by the client. The response of Vaultwarden will be exactly the same (at least until v2024.12 is out) for each client.

Without that, I'm not able to do any checking at all.

<!-- gh-comment-id:2514314004 --> @BlackDex commented on GitHub (Dec 3, 2024): As mentioned before, everything in `/mobile` is not the native app. Only applications in `/ios` or `/android` are the native apps. It doesn't matter if the error occurs or not on your browser, i need the **har** file which includes an unmodified response of the sync request done by the client. The response of Vaultwarden will be exactly the same (at least until v2024.12 is out) for each client. Without that, I'm not able to do any checking at all.
Author
Owner

@JunfXiao commented on GitHub (Dec 3, 2024):

As mentioned before, everything in /mobile is not the native app. Only applications in /ios or /android are the native apps.

It doesn't matter if the error occurs or not on your browser, i need the har file which includes an unmodified response of the sync request done by the client. The response of Vaultwarden will be exactly the same (at least until v2024.12 is out) for each client.

Without that, I'm not able to do any checking at all.

Hi, here's the har file for your reference:
https://1drv.ms/u/s!ArsqJ8_aARYGoocbnG9BnICVpo3XXA?e=la3ISu

It seems that the server cannot communicate with the official bitwarden server for push token when the client requested it with /identify/connect/token request body. The message:

Unexcepted push token received from bitwarden server: error decoding response body.

from here:
github.com/dani-garcia/vaultwarden@da3701c0cf/src/api/push.rs (L66-L69)

Is there a way to exam what it really got from official server?

<!-- gh-comment-id:2514605026 --> @JunfXiao commented on GitHub (Dec 3, 2024): > As mentioned before, everything in `/mobile` is not the native app. Only applications in `/ios` or `/android` are the native apps. > > It doesn't matter if the error occurs or not on your browser, i need the **har** file which includes an unmodified response of the sync request done by the client. The response of Vaultwarden will be exactly the same (at least until v2024.12 is out) for each client. > > Without that, I'm not able to do any checking at all. Hi, here's the har file for your reference: https://1drv.ms/u/s!ArsqJ8_aARYGoocbnG9BnICVpo3XXA?e=la3ISu It seems that the server cannot communicate with the official bitwarden server for push token when the client requested it with `/identify/connect/token` request body. The message: ``` Unexcepted push token received from bitwarden server: error decoding response body. ``` from here: https://github.com/dani-garcia/vaultwarden/blob/da3701c0cfa5fb0fe505c18c5f210edb2a71aaf9/src/api/push.rs#L66-L69 Is there a way to exam what it really got from official server?
Author
Owner

@BlackDex commented on GitHub (Dec 3, 2024):

The only way to do that is by putting a reverse proxy like mitmproxy in between Vaultwarden and the internet.

<!-- gh-comment-id:2514612235 --> @BlackDex commented on GitHub (Dec 3, 2024): The only way to do that is by putting a reverse proxy like mitmproxy in between Vaultwarden and the internet.
Author
Owner

@BlackDex commented on GitHub (Dec 3, 2024):

Also, i think your issue @JunfXiao has notthing to do with the main issue of this topic.
Please open a discussion not linked to this issue please.

<!-- gh-comment-id:2514619982 --> @BlackDex commented on GitHub (Dec 3, 2024): Also, i think your issue @JunfXiao has notthing to do with the main issue of this topic. Please open a discussion not linked to this issue please.
Author
Owner

@diagpope commented on GitHub (Dec 3, 2024):

@BlackDex
I created a har file, clicked Export HAR (sanitized) but noticed that it contains a lots of sensitive data , such as:
masterPasswordHint, full name, full domain, server IP, some vault item IPs
Is there a suggested scrubbing tool?

<!-- gh-comment-id:2515494323 --> @diagpope commented on GitHub (Dec 3, 2024): @BlackDex I created a har file, clicked Export HAR (sanitized) but noticed that it contains a lots of sensitive data , such as: masterPasswordHint, full name, full domain, server IP, some vault item IPs Is there a suggested scrubbing tool?
Author
Owner

@BlackDex commented on GitHub (Dec 3, 2024):

No, not really. Scrubbing it will remove data i need to check.
Of course you maye remove the password hint. But other stuff might break the file and causes me to be unable to check and search for possible issues.

That is why i suggested in the posted i linked to to send it either via email, or via matrix chat, at which via matrix is preferred.

I have received multiple of those files already, and it helped to fix issues, and i have no interest in trying to decrypt your data in any way.

<!-- gh-comment-id:2515522773 --> @BlackDex commented on GitHub (Dec 3, 2024): No, not really. Scrubbing it will remove data i need to check. Of course you maye remove the password hint. But other stuff might break the file and causes me to be unable to check and search for possible issues. That is why i suggested in the posted i linked to to send it either via email, or via matrix chat, at which via matrix is preferred. I have received multiple of those files already, and it helped to fix issues, and i have no interest in trying to decrypt your data in any way.
Author
Owner

@sleshep commented on GitHub (Dec 5, 2024):

After update caddy(build from latest source), it solve my issue.
May this help you.

<!-- gh-comment-id:2519728492 --> @sleshep commented on GitHub (Dec 5, 2024): After update caddy(build from latest source), it solve my issue. May this help you.
Author
Owner

@BlackDex commented on GitHub (Dec 5, 2024):

@sleshep any idea what might have caused the issues then? Which option/feature/bug made caddy break the clients?

<!-- gh-comment-id:2519749205 --> @BlackDex commented on GitHub (Dec 5, 2024): @sleshep any idea what might have caused the issues then? Which option/feature/bug made caddy break the clients?
Author
Owner

@sleshep commented on GitHub (Dec 5, 2024):

@sleshep any idea what might have caused the issues then? Which option/feature/bug made caddy break the clients?

I guest it happend during TLS negotiation or something before request arrived vaultwarden, because i can't find any caddy access logs when i press bitwarden android login button.

<!-- gh-comment-id:2519762536 --> @sleshep commented on GitHub (Dec 5, 2024): > @sleshep any idea what might have caused the issues then? Which option/feature/bug made caddy break the clients? I guest it happend during TLS negotiation or something before request arrived vaultwarden, because i can't find any caddy access logs when i press bitwarden android login button.
Author
Owner

@diagpope commented on GitHub (Dec 5, 2024):

In my case, a failing setup, there was no update to caddy:latest as of today, was the caddy update a different tag?

latest: Pulling from library/caddy
Digest: sha256:07417b42b03b8929ec80240d1a83e27a9c1346ddbff65988608fd1757269c1eb
Status: Image is up to date for caddy:latest
docker.io/library/caddy:latest
<!-- gh-comment-id:2520411582 --> @diagpope commented on GitHub (Dec 5, 2024): In my case, a failing setup, there was no update to caddy:latest as of today, was the caddy update a different tag? ``` latest: Pulling from library/caddy Digest: sha256:07417b42b03b8929ec80240d1a83e27a9c1346ddbff65988608fd1757269c1eb Status: Image is up to date for caddy:latest docker.io/library/caddy:latest ```
Author
Owner

@BlackDex commented on GitHub (Dec 5, 2024):

I have found the issue thanks too two people who provided a har file.
It's a reprompt value in the database which does not equals either NULL, 0, or 1.
In both cases they were 4. How this could have happened I have no idea.

Adjusting that to either of the valid values will resolve the issue.

Now, it could be this is not the case for all other users.
To debug it a bit better, people could download the dev build from the Actions pages, like here: https://github.com/bitwarden/android/actions/runs/12186085669

Install that apk, run it login as usual and see if it still fails.
If that is the case, people should install adb and run adb logcat while there phone is connected via USB or wireless to allow debug access to the phone.

Click on the retry button, and there should be a stack trace somewhere.
That does show a very non-descriptive message which helped to find it.

A better howto should be created i think, but at least the basic steps are described here now.

<!-- gh-comment-id:2521733515 --> @BlackDex commented on GitHub (Dec 5, 2024): I have found the issue thanks too two people who provided a `har` file. It's a `reprompt` value in the database which does not equals either `NULL`, `0`, or `1`. In both cases they were `4`. How this could have happened I have no idea. Adjusting that to either of the valid values will resolve the issue. Now, it could be this is not the case for all other users. To debug it a bit better, people could download the `dev` build from the Actions pages, like here: https://github.com/bitwarden/android/actions/runs/12186085669 Install that `apk`, run it login as usual and see if it still fails. If that is the case, people should install `adb` and run `adb logcat` while there phone is connected via USB or wireless to allow debug access to the phone. Click on the retry button, and there should be a stack trace somewhere. That does show a very non-descriptive message which helped to find it. A better howto should be created i think, but at least the basic steps are described here now.
Author
Owner

@306bobby-android commented on GitHub (Dec 8, 2024):

I have found the issue thanks too two people who provided a har file. It's a reprompt value in the database which does not equals either NULL, 0, or 1. In both cases they were 4. How this could have happened I have no idea.

Adjusting that to either of the valid values will resolve the issue.

Now, it could be this is not the case for all other users. To debug it a bit better, people could download the dev build from the Actions pages, like here: https://github.com/bitwarden/android/actions/runs/12186085669

Install that apk, run it login as usual and see if it still fails. If that is the case, people should install adb and run adb logcat while there phone is connected via USB or wireless to allow debug access to the phone.

Click on the retry button, and there should be a stack trace somewhere. That does show a very non-descriptive message which helped to find it.

A better howto should be created i think, but at least the basic steps are described here now.

Here is the network result

12-08 13:44:30.360 W/NetworkResultCall(29074): Network Error: https://api.bitwarden.com/accounts/prelogin
12-08 13:44:30.360 W/NetworkResultCall(29074): kotlinx.serialization.MissingFieldException: Fields [kdf, kdfIterations] are required for type with serial name 'com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson', but they were missing at path: $
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.platform.datasource.network.serializer.BaseSurrogateSerializer.deserialize(BaseSurrogateSerializer.kt:41)
12-08 13:44:30.360 W/NetworkResultCall(29074): Caused by: kotlinx.serialization.MissingFieldException: Fields [kdf, kdfIterations] are required for type with serial name 'com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson', but they were missing
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson.(InternalPreLoginResponseJson.kt:11)
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson.(Unknown Source:0)
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson$$serializer.deserialize(InternalPreLoginResponseJson.kt:11)
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson$$serializer.deserialize(InternalPreLoginResponseJson.kt:11)

I can attach more if needed

<!-- gh-comment-id:2526330057 --> @306bobby-android commented on GitHub (Dec 8, 2024): > I have found the issue thanks too two people who provided a `har` file. It's a `reprompt` value in the database which does not equals either `NULL`, `0`, or `1`. In both cases they were `4`. How this could have happened I have no idea. > > Adjusting that to either of the valid values will resolve the issue. > > Now, it could be this is not the case for all other users. To debug it a bit better, people could download the `dev` build from the Actions pages, like here: https://github.com/bitwarden/android/actions/runs/12186085669 > > Install that `apk`, run it login as usual and see if it still fails. If that is the case, people should install `adb` and run `adb logcat` while there phone is connected via USB or wireless to allow debug access to the phone. > > Click on the retry button, and there should be a stack trace somewhere. That does show a very non-descriptive message which helped to find it. > > A better howto should be created i think, but at least the basic steps are described here now. Here is the network result 12-08 13:44:30.360 W/NetworkResultCall(29074): Network Error: https://api.bitwarden.com/accounts/prelogin 12-08 13:44:30.360 W/NetworkResultCall(29074): kotlinx.serialization.MissingFieldException: Fields [kdf, kdfIterations] are required for type with serial name 'com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson', but they were missing at path: $ 12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.platform.datasource.network.serializer.BaseSurrogateSerializer.deserialize(BaseSurrogateSerializer.kt:41) 12-08 13:44:30.360 W/NetworkResultCall(29074): Caused by: kotlinx.serialization.MissingFieldException: Fields [kdf, kdfIterations] are required for type with serial name 'com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson', but they were missing 12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson.<init>(InternalPreLoginResponseJson.kt:11) 12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson.<init>(Unknown Source:0) 12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson$$serializer.deserialize(InternalPreLoginResponseJson.kt:11) 12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson$$serializer.deserialize(InternalPreLoginResponseJson.kt:11) I can attach more if needed
Author
Owner

@BlackDex commented on GitHub (Dec 8, 2024):

@306bobby-android, looks like you are not using the latest version of Vaultwarden.

Those fields are returned always since forever.
And they changed to camelCase since v1.31.0.

<!-- gh-comment-id:2526333665 --> @BlackDex commented on GitHub (Dec 8, 2024): @306bobby-android, looks like you are not using the latest version of Vaultwarden. Those fields are returned always since forever. And they changed to camelCase since v1.31.0.
Author
Owner

@306bobby-android commented on GitHub (Dec 8, 2024):

Interesting, then my docker is messing with me. Let me verify my version
number and get it updated and report back if I'm still encountering the
issue with a better log

On Sun, Dec 8, 2024, 2:08 PM Mathijs van Veluw @.***>
wrote:

@306bobby-android https://github.com/306bobby-android, looks like you
are not using the latest version of Vaultwarden.

Those fields are returned always since forever.
And they changed to camelCase since v1.31.0.


Reply to this email directly, view it on GitHub
https://github.com/dani-garcia/vaultwarden/issues/5237#issuecomment-2526333665,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/BCI56WC6AG6T4MRVMVXKLYD2ESKJVAVCNFSM6AAAAABSR446NKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMRWGMZTGNRWGU
.
You are receiving this because you were mentioned.Message ID:
@.***>

<!-- gh-comment-id:2526337598 --> @306bobby-android commented on GitHub (Dec 8, 2024): Interesting, then my docker is messing with me. Let me verify my version number and get it updated and report back if I'm still encountering the issue with a better log On Sun, Dec 8, 2024, 2:08 PM Mathijs van Veluw ***@***.***> wrote: > @306bobby-android <https://github.com/306bobby-android>, looks like you > are not using the latest version of Vaultwarden. > > Those fields are returned always since forever. > And they changed to camelCase since v1.31.0. > > — > Reply to this email directly, view it on GitHub > <https://github.com/dani-garcia/vaultwarden/issues/5237#issuecomment-2526333665>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/BCI56WC6AG6T4MRVMVXKLYD2ESKJVAVCNFSM6AAAAABSR446NKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMRWGMZTGNRWGU> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >
Author
Owner

@diagpope commented on GitHub (Dec 22, 2024):

The latest update from 2024.12.0 (19597) works on android for me.

<!-- gh-comment-id:2558321696 --> @diagpope commented on GitHub (Dec 22, 2024): The latest update from 2024.12.0 (19597) works on android for me.
Author
Owner

@sairuk commented on GitHub (Dec 29, 2024):

same client 2024.12.0 (19597) with docker 1.32.7 worked for a brief period after reinstall (i.e. overnight) now no longer working, "last sync" under Settings->Other is blank, was populated with initial sync date after reinstall/setup

<!-- gh-comment-id:2564563757 --> @sairuk commented on GitHub (Dec 29, 2024): same client 2024.12.0 (19597) with docker 1.32.7 worked for a brief period after reinstall (i.e. overnight) now no longer working, "last sync" under `Settings->Other` is blank, was populated with initial sync date after reinstall/setup
Author
Owner

@Cromoray commented on GitHub (Mar 24, 2025):

Any update on how to solve the problem?

<!-- gh-comment-id:2747881590 --> @Cromoray commented on GitHub (Mar 24, 2025): Any update on how to solve the problem?
Author
Owner

@Gerardv514 commented on GitHub (Mar 25, 2025):

Any update on how to solve the problem?

No problem anymore considering this issue is closed

<!-- gh-comment-id:2749841148 --> @Gerardv514 commented on GitHub (Mar 25, 2025): > Any update on how to solve the problem? No problem anymore considering this issue is closed
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/vaultwarden#2103
No description provided.