mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-26 01:35:54 +03:00
[GH-ISSUE #5237] Android bitwarden app stopped having access to vault #2103
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#2103
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @diagpope on GitHub (Nov 27, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5237
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config (Generated via diagnostics page)
Show Running Config
Environment settings which are overridden:
Vaultwarden Build Version
Version 2024.6.2
Deployment method
Official Container Image
Custom deployment method
No: Plain docker-compose, caddy, fail2ban
Reverse Proxy
image: caddy:2
Host/Server Operating System
Linux
Operating System Version
Ubuntu 22.04.5 LTS
Clients
Android
Client Version
latest bitwarden
Steps To Reproduce
Expected Result
Successful login
Actual Result
We were unable to process your request. Please try again or contact us.
Logs
Screenshots or Videos
I can log into the vault from any other OS, web browser and extension.
This problem existed a few months ago and disappeared (reboot phone)
This time I signed up for bitwarden beta which has no newer release and also tried uninstall and reinstall
Additional Context
It seems that I am logged in as I can change settings but there is no vault access.
@BlackDex commented on GitHub (Nov 27, 2024):
For some strange reason still unknown, some users have issues like this. Unfortunately nobody is able to figure out what the exact issue is.
You might want to try the following steps described here.
https://github.com/dani-garcia/vaultwarden/discussions/5152#discussioncomment-11146453
But first make sure you have a backup of your database and data finder!
@diagpope commented on GitHub (Nov 27, 2024):
@BlackDex
Thanks for the link.
I changed the masterpassword with "rotate my account's encryption key" - no fix
I also changed the KBF - no fix
clear storage, clear cache, uninstall Android's bitwarden - no fix
Now it does not accept the 6 digit verification code or the recovery code
Even disabling the 2FA on the web still makes the android app ask fro 2FA .. therefore
uninstalled again - logged in w/o 2FA but vault is still inaccessible
How do I see potential problems on the instance. Is the proxy log the only one or should vaulwarden itself also produce log files? I read on some posts that users look at cipher exchange between client and instance
@mindonwarp commented on GitHub (Nov 27, 2024):
I've been having this issue as well. I first noticed it a month ago and ignored it until I couldn't even use the autofill option anymore.
I updated my vaultwarden docker image to the latest version at that time a few weeks ago (can't remember which version it was) and the android app worked again.
I have watchtower running and it recently updated the vaultwarden image and now the android app is not working again. Maybe the version is somehow important?
I'll revert my vaultwarden image back to an earlier version in hopes it will help, and disable watchtower monitoring for the container.
@BlackDex commented on GitHub (Nov 27, 2024):
I would not recommend to revert to an older version. Mainly because of security bugs. Also the latest version should have better fixes for the new native clients and sound work better.
If it doesn't work, I would need more info.
See https://github.com/dani-garcia/vaultwarden/issues/4870#issuecomment-2306749481 on how to extract these details for me.
@diagpope commented on GitHub (Nov 27, 2024):
This is the version from the Google Play store that did not work
The log file produced with
sudo tcpflow -i any -C port 80on the failed access istcpflow.broken.gz
Then I installed from https://github.com/bitwarden/mobile/releases this version:
Version 2024.7.1
Access to the vault was restored. log file produced with
sudo tcpflow -i any -C port 80on the successful access istcpflow.success.gz
How can I self diagnose this next time?
@mindonwarp commented on GitHub (Nov 28, 2024):
The configuration that is now working for me:
@BlackDex commented on GitHub (Nov 28, 2024):
@dombrowa the version you are using now is not the native client.
Those can be found at the
bitwarden/androidrepo not thebitwarden/mobile.I'll have to shift through the data and see if i can give anything which might break the client. But that isn't going to be easy.
Something in te response of the server, most likely the sync request is sending something the native clients do not support our crash on. What this is exactly isn't easy to tell. Since I'm not able to reproduce this my self.
@BlackDex commented on GitHub (Nov 28, 2024):
@dombrowa Unfortunately those tcpflows are not useful for me.
I think you tried to remove some sensitive data, which mangled the whole json. If I'm not able to see the json in it's original form i can't try to debug this. It will take me to much time, and i can't tell if there is something wrong with Vaultwarden, or if it is something deleted/mangled by you.
@diamondtipdr commented on GitHub (Nov 28, 2024):
I tried the android Bitwarden native app (as part of the beta in the Play Store), and it didn't like my VW instance. Had to change back to the standard version available in the Store (2024.10.0 11270) for it to work.
@diagpope commented on GitHub (Nov 29, 2024):
@BlackDex
The command I used to capture was:
Then, I only used sed commands to redact text as such:
Is there a better way to capture traces?
When I look at the log files, they seem to contain mostly HTTP headers that are not json, and only a few lines of json that can be parsed via jq (example below)
@diagpope commented on GitHub (Nov 29, 2024):
Interesting, when I ran
I encountered the failure.
Either the android client or the combination of android client and proxy caused the problem on android mobile.
It seemed to work in iOS which I do not use.
@BlackDex commented on GitHub (Nov 29, 2024):
The only issue i know of regarding reverse proxies is if they do some security filtering, or override headers.
@dombrowa well, that redaction caused the output to be not useable for me.
The other way would be generating the har file via the browser just on your desktop. There sync output should be exactly the same, so that will be fine. But i would not suggest to put that har file here.
Use the contact options i suggested in the link.
@diagpope commented on GitHub (Dec 3, 2024):
@BlackDex
Question: If I use my browser on the desktop, I do not encounter the login failure to vaultwarden.
How to I get an har file when using the bitwarden mobile app?
When I run this, I see the not redacted output is not recognized json either:
@diagpope commented on GitHub (Dec 3, 2024):
I tried the following versions from https://github.com/bitwarden/android
only this one below works for my android 11 OS. It is not from the android page but
https://github.com/bitwarden/mobile
@BlackDex commented on GitHub (Dec 3, 2024):
As mentioned before, everything in
/mobileis not the native app.Only applications in
/iosor/androidare the native apps.It doesn't matter if the error occurs or not on your browser, i need the har file which includes an unmodified response of the sync request done by the client. The response of Vaultwarden will be exactly the same (at least until v2024.12 is out) for each client.
Without that, I'm not able to do any checking at all.
@JunfXiao commented on GitHub (Dec 3, 2024):
Hi, here's the har file for your reference:
https://1drv.ms/u/s!ArsqJ8_aARYGoocbnG9BnICVpo3XXA?e=la3ISu
It seems that the server cannot communicate with the official bitwarden server for push token when the client requested it with
/identify/connect/tokenrequest body. The message:from here:
github.com/dani-garcia/vaultwarden@da3701c0cf/src/api/push.rs (L66-L69)Is there a way to exam what it really got from official server?
@BlackDex commented on GitHub (Dec 3, 2024):
The only way to do that is by putting a reverse proxy like mitmproxy in between Vaultwarden and the internet.
@BlackDex commented on GitHub (Dec 3, 2024):
Also, i think your issue @JunfXiao has notthing to do with the main issue of this topic.
Please open a discussion not linked to this issue please.
@diagpope commented on GitHub (Dec 3, 2024):
@BlackDex
I created a har file, clicked Export HAR (sanitized) but noticed that it contains a lots of sensitive data , such as:
masterPasswordHint, full name, full domain, server IP, some vault item IPs
Is there a suggested scrubbing tool?
@BlackDex commented on GitHub (Dec 3, 2024):
No, not really. Scrubbing it will remove data i need to check.
Of course you maye remove the password hint. But other stuff might break the file and causes me to be unable to check and search for possible issues.
That is why i suggested in the posted i linked to to send it either via email, or via matrix chat, at which via matrix is preferred.
I have received multiple of those files already, and it helped to fix issues, and i have no interest in trying to decrypt your data in any way.
@sleshep commented on GitHub (Dec 5, 2024):
After update caddy(build from latest source), it solve my issue.
May this help you.
@BlackDex commented on GitHub (Dec 5, 2024):
@sleshep any idea what might have caused the issues then? Which option/feature/bug made caddy break the clients?
@sleshep commented on GitHub (Dec 5, 2024):
I guest it happend during TLS negotiation or something before request arrived vaultwarden, because i can't find any caddy access logs when i press bitwarden android login button.
@diagpope commented on GitHub (Dec 5, 2024):
In my case, a failing setup, there was no update to caddy:latest as of today, was the caddy update a different tag?
@BlackDex commented on GitHub (Dec 5, 2024):
I have found the issue thanks too two people who provided a
harfile.It's a
repromptvalue in the database which does not equals eitherNULL,0, or1.In both cases they were
4. How this could have happened I have no idea.Adjusting that to either of the valid values will resolve the issue.
Now, it could be this is not the case for all other users.
To debug it a bit better, people could download the
devbuild from the Actions pages, like here: https://github.com/bitwarden/android/actions/runs/12186085669Install that
apk, run it login as usual and see if it still fails.If that is the case, people should install
adband runadb logcatwhile there phone is connected via USB or wireless to allow debug access to the phone.Click on the retry button, and there should be a stack trace somewhere.
That does show a very non-descriptive message which helped to find it.
A better howto should be created i think, but at least the basic steps are described here now.
@306bobby-android commented on GitHub (Dec 8, 2024):
Here is the network result
12-08 13:44:30.360 W/NetworkResultCall(29074): Network Error: https://api.bitwarden.com/accounts/prelogin
12-08 13:44:30.360 W/NetworkResultCall(29074): kotlinx.serialization.MissingFieldException: Fields [kdf, kdfIterations] are required for type with serial name 'com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson', but they were missing at path: $
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.platform.datasource.network.serializer.BaseSurrogateSerializer.deserialize(BaseSurrogateSerializer.kt:41)
12-08 13:44:30.360 W/NetworkResultCall(29074): Caused by: kotlinx.serialization.MissingFieldException: Fields [kdf, kdfIterations] are required for type with serial name 'com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson', but they were missing
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson.(InternalPreLoginResponseJson.kt:11)
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson.(Unknown Source:0)
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson$$serializer.deserialize(InternalPreLoginResponseJson.kt:11)
12-08 13:44:30.360 W/NetworkResultCall(29074): at com.x8bit.bitwarden.data.auth.datasource.network.model.InternalPreLoginResponseJson$$serializer.deserialize(InternalPreLoginResponseJson.kt:11)
I can attach more if needed
@BlackDex commented on GitHub (Dec 8, 2024):
@306bobby-android, looks like you are not using the latest version of Vaultwarden.
Those fields are returned always since forever.
And they changed to camelCase since v1.31.0.
@306bobby-android commented on GitHub (Dec 8, 2024):
Interesting, then my docker is messing with me. Let me verify my version
number and get it updated and report back if I'm still encountering the
issue with a better log
On Sun, Dec 8, 2024, 2:08 PM Mathijs van Veluw @.***>
wrote:
@diagpope commented on GitHub (Dec 22, 2024):
The latest update from 2024.12.0 (19597) works on android for me.
@sairuk commented on GitHub (Dec 29, 2024):
same client 2024.12.0 (19597) with docker 1.32.7 worked for a brief period after reinstall (i.e. overnight) now no longer working, "last sync" under
Settings->Otheris blank, was populated with initial sync date after reinstall/setup@Cromoray commented on GitHub (Mar 24, 2025):
Any update on how to solve the problem?
@Gerardv514 commented on GitHub (Mar 25, 2025):
No problem anymore considering this issue is closed