mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-26 01:35:54 +03:00
[GH-ISSUE #583] Breach Report - HaveIBeenPwned APIv2 No Longer Works #383
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#383
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Ayitaka on GitHub (Aug 20, 2019).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/583
[2019-08-20 15:36:37][bitwarden_rs::error][ERROR] ReqError. [CAUSE] Error( Status( 401, ), "https://haveibeenpwned.com/api/v2/breachedaccount/email@example.com", )With regards to the HaveIBeenPwned developer's blog, as of August 18th HaveIBeenPwned no longer allows unauthenticated API requests based on email address and therefore the Data Breach Report no longer works without a paid account from HaveIBeenPwned.
Note: The "Exposed Passwords Report" section still functions properly as this was unaffected by the API v3 changes.
Since I assume we cannot utilize the bitwarden.com api calls, perhaps it would be a good idea to:
(Edit: Upon further thinking, there has to be a way Bitwarden allows self-installations to utilize the bitwarden api for Breach Reports - maybe in conjunction with "Get an installation id and key from https://bitwarden.com/host." ?)Self-hosted official Bitwarden is the same as vaultwarden in that there is a config setting for adding your own HIBP API key - it does not utilize Bitwarden's API key.@dani-garcia commented on GitHub (Aug 20, 2019):
As far as I know the official server seems to allow the self hosting installations to configure their own key, which is what we should do too. Should be an easy change, so I'll try to get it done today, though I don't have a key to test, it's not like I could break it more :).
@Ayitaka commented on GitHub (Aug 20, 2019):
I can provide you with a temporary api key to test with if that would help- I sent you a msg/chat invite on #bitwarden_rs:matrix.org
@TomasTokaMrazek commented on GitHub (Sep 29, 2019):
Is this really fixed? The commit is tagged as 1.10.0, which I just updated to, yet I keep getting error about no API keys.
EDIT: My bad, API is paid now
@Ayitaka commented on GitHub (Sep 29, 2019):
Yes, sorry that wasn't clearer in the initial post.
HaveIBeenPwned now requires a monthly API Key subscription to do email address checks through their API, which is how Bitwarden does the checks.
Password compromise checks are still free and work just fine within Bitwarden, only email checks no longer work without the API key.
You can get a subscription at the HaveIBeenPwned API page for $3.50USD/month.
You would then add the key to Bitwarden_rs using the .env setting: HIBP_API_KEY=apikeyhere
Alternatively, you can still do manual email address checks through the main HaveIBeenPwned website, but that isn't part of Bitwarden_rs.
@Crush33 commented on GitHub (Jul 28, 2021):
hi, could you please help me setting this up in docker environnement ? I dont really understand where to put the api key...
thx !
@Saik0Shinigami commented on GitHub (Jul 28, 2021):
In the /admin page under "general settings", or as an environmental variable in docker.
@d0x7 commented on GitHub (Oct 9, 2021):
Just found this issue and thinking about what you said here. Did anyone look into this deeper? I mean, if the self hosted instances can use the email breach feature without supplying a key (even tho they apparently can, optionally?), therefore accessing the HIBP API directly or maybe even proxied through Bitwarden (self hosted calls Bitwarden.com with license which then calls HIBP with their API key), then it should be able to implement this into Vaultwarden aswell, you would only need to request a hosting installation key - even if it's morally questionable. But all that depends on whether the self hosted Bitwarden instances can use the email breach feature, or if the HIBP api key is absolutely mandatory (wasn't really clear for me what you guys said).
@Ayitaka commented on GitHub (Oct 9, 2021):
Self-hosted official Bitwarden is the same as vaultwarden: there is a place to add your HIBP API key to enable checking breach reports for email addresses.
A HIBP API key costs $3.50US per month. So if the convenience of allowing you and your users to check email addresses against HIBP is worthwhile, an API key is about half the price of a Starbucks coffee every month. Otherwise, you can still go directly to HaveIBeenPwned and enter email addresses into their webpage to check them manually.
@BlackDex commented on GitHub (Oct 9, 2021):
I don't know why you think self-hosted can use this feature without any api-key, because that isn't true.
The only place where you can use this feature for 'free' is on vault.bitwarden.com, which provide this feature for they customers.
Self-Hosted still needs a key to have this working from the web-vault.
I think vaultwarden has made a simple compromise which takes just 3 clicks from doing the same.
If you wish it to be just one click, i suggest to buy an api-key and use that.