starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-26 01:35:54 +03:00

[GH-ISSUE #5924] "NetworkError when attempting to fetch resource." check for compromised password #2288

New issue

Closed

opened 2026-03-03 02:16:56 +03:00 by kerem · 2 comments

kerem commented

2026-03-03 02:16:56 +03:00

Owner

Originally created by @Joly0 on GitHub (Jun 2, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5924

Vaultwarden Support String

Your environment (Generated via diagnostics page)

Vaultwarden version: v1.34.1
Web-vault version: v2025.5.0
OS/Arch: linux/x86_64
Running within a container: true (Base: Debian)
Database type: SQLite
Database version: 3.49.1
Uses config.json: true
Uses a reverse proxy: true
IP Header check: true (X-Real-IP)
Internet access: true
Internet access via a proxy: false
DNS Check: true
TZ environment: Europe/Berlin
Browser/Server Time Check: true
Server/NTP Time Check: true
Domain Configuration Check: true
HTTPS Check: true
Websocket Check: true
HTTP Response Checks: false

Config & Details (Generated via diagnostics page)

Show Config & Details

Environment settings which are overridden: SIGNUPS_ALLOWED, INVITATIONS_ALLOWED, ADMIN_TOKEN

Failed HTTP Checks:

API calls:
Header: 'referrer-policy' does not contain 'same-origin'
Header: 'x-robots-tag' does not contain 'noindex'
Header: 'x-robots-tag' does not contain 'nofollow'
Header: 'content-security-policy' does not contain 'default-src 'none''
Header: 'content-security-policy' does not contain 'manifest-src 'self''
Header: 'content-security-policy' does not contain 'base-uri 'self''
Header: 'content-security-policy' does not contain 'form-action 'self''
Header: 'content-security-policy' does not contain 'object-src 'self' blob:'
Header: 'content-security-policy' does not contain 'script-src 'self' 'wasm-unsafe-eval''
Header: 'content-security-policy' does not contain 'child-src 'self' https://*.duosecurity.com https://*.duofederal.com'
Header: 'content-security-policy' does not contain 'frame-src 'self' https://*.duosecurity.com https://*.duofederal.com'
Header: 'content-security-policy' does not contain 'frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://*'
Header: 'content-security-policy' does not contain 'img-src 'self' data: https://haveibeenpwned.com'
Header: 'content-security-policy' does not contain 'connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net'
2FA Connector calls:
Header: 'referrer-policy' does not contain 'same-origin'
Header: 'x-robots-tag' does not contain 'noindex'
Header: 'x-robots-tag' does not contain 'nofollow'
Header: 'x-frame-options' is present while it should not
Header: 'content-security-policy' is present while it should not

Config:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*******************",
  "domain_origin": "*****://*******************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "fido2-vault-credentials,ssh-key-vault-item,ssh-agent",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": "***",
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": false,
  "password_iterations": 100000,
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://api.bitwarden.eu",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": true,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "*******************",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "**************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "*******************",
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

v1.34.1

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

Nginx Proxy Manager (latest)

Host/Server Operating System

Linux

Operating System Version

Unraid

Clients

Browser Extension, Web Vault, Android

Client Version

No response

Steps To Reproduce

Save Hibp api key in admin settings
Go to webvault
Open entry and click on small checkmark button
See error

Also, in the admin console under reports when checking for compromised passwords not much happens. I can see, that something loads, but i never get to see anything.

Expected Result

Should check if password is compromisedd

Actual Result

Logs

Screenshots or Videos

No response

Additional Context

No response

Originally created by @Joly0 on GitHub (Jun 2, 2025). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5924 ### Vaultwarden Support String ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.34.1 * Web-vault version: v2025.5.0 * OS/Arch: linux/x86_64 * Running within a container: true (Base: Debian) * Database type: SQLite * Database version: 3.49.1 * Uses config.json: true * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * TZ environment: Europe/Berlin * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Websocket Check: true * HTTP Response Checks: false ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Environment settings which are overridden:** SIGNUPS_ALLOWED, INVITATIONS_ALLOWED, ADMIN_TOKEN **Failed HTTP Checks:** ```yaml API calls: Header: 'referrer-policy' does not contain 'same-origin' Header: 'x-robots-tag' does not contain 'noindex' Header: 'x-robots-tag' does not contain 'nofollow' Header: 'content-security-policy' does not contain 'default-src 'none'' Header: 'content-security-policy' does not contain 'manifest-src 'self'' Header: 'content-security-policy' does not contain 'base-uri 'self'' Header: 'content-security-policy' does not contain 'form-action 'self'' Header: 'content-security-policy' does not contain 'object-src 'self' blob:' Header: 'content-security-policy' does not contain 'script-src 'self' 'wasm-unsafe-eval'' Header: 'content-security-policy' does not contain 'child-src 'self' https://*.duosecurity.com https://*.duofederal.com' Header: 'content-security-policy' does not contain 'frame-src 'self' https://*.duosecurity.com https://*.duofederal.com' Header: 'content-security-policy' does not contain 'frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://*' Header: 'content-security-policy' does not contain 'img-src 'self' data: https://haveibeenpwned.com' Header: 'content-security-policy' does not contain 'connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net' 2FA Connector calls: Header: 'referrer-policy' does not contain 'same-origin' Header: 'x-robots-tag' does not contain 'noindex' Header: 'x-robots-tag' does not contain 'nofollow' Header: 'x-frame-options' is present while it should not Header: 'content-security-policy' is present while it should not ``` **Config:** ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_max_conns": 10, "database_timeout": 30, "database_url": "***************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://*******************", "domain_origin": "*****://*******************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "fido2-vault-credentials,ssh-key-vault-item,ssh-agent", "extended_logging": true, "helo_name": null, "hibp_api_key": "***", "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": false, "password_iterations": 100000, "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://api.bitwarden.eu", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "", "signups_verify": true, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "*******************", "smtp_from_name": "Vaultwarden", "smtp_host": "**************", "smtp_password": "***", "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": "*******************", "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> ### Vaultwarden Build Version v1.34.1 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy Nginx Proxy Manager (latest) ### Host/Server Operating System Linux ### Operating System Version Unraid ### Clients Browser Extension, Web Vault, Android ### Client Version _No response_ ### Steps To Reproduce 1. Save Hibp api key in admin settings 2. Go to webvault 3. Open entry and click on small checkmark button 4. See error Also, in the admin console under reports when checking for compromised passwords not much happens. I can see, that something loads, but i never get to see anything. ### Expected Result Should check if password is compromisedd ### Actual Result ![Image](https://github.com/user-attachments/assets/9f0d212a-76eb-4d6a-ae77-add8f300ed2c) ### Logs ```text ``` ### Screenshots or Videos _No response_ ### Additional Context _No response_

kerem

2026-03-03 02:16:56 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-03 02:16:57 +03:00

Author

Owner

@Joly0 commented on GitHub (Jun 2, 2025):

Not sure if important, i just bought the api key and i bought the cheapest subscription

@Joly0 commented on GitHub (Jun 2, 2025): Not sure if important, i just bought the api key and i bought the cheapest subscription

kerem commented

2026-03-03 02:16:57 +03:00

Author

Owner

@BlackDex commented on GitHub (Jun 2, 2025):

You have several failed http checks which prevents the correct working of Vaultwarden and several features, one of which is these checks.

Compromised passwords do not need a HiBP API key btw, that is only needed for data breach checks.

Probably your reverse proxy is adding or modifying the security headers which tend to break Vaultwarden.

@BlackDex commented on GitHub (Jun 2, 2025): You have several failed http checks which prevents the correct working of Vaultwarden and several features, one of which is these checks. Compromised passwords do not need a HiBP API key btw, that is only needed for data breach checks. Probably your reverse proxy is adding or modifying the security headers which tend to break Vaultwarden.