mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-03-02 22:57:18 -05:00
Unable to run bitwarden_rs with nginx and basic auth #605
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#605
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Zuendapp on GitHub (Feb 9, 2020).
Hi,
I tried to secure my installation via basic auth because the client app for iOS doesn't support Client Certs further.
When I try to set the basic auth in nginx initially it works to login for basic auth, but after I'm trying to login to Bitwarden there is a never ending prompt for the basic auth and no content is showing.
Also when I save the username and password via browser theres no chance.
Do you have an idea?
Thank you very much!
BR
@cryptoluks commented on GitHub (Feb 9, 2020):
Can you observe anything relevant in your server/client logs?
@Zuendapp commented on GitHub (Feb 10, 2020):
Hi, do you mean the nginx log or the Bitwarden log? Which log level should I choose to in bitwarden?
Thank you
@Zuendapp commented on GitHub (Feb 10, 2020):
Here is my log with level "trace":
@Zuendapp commented on GitHub (Feb 10, 2020):
Sorry for this long log. It's only from start the docker container until login.
Thank you!
@khimaros commented on GitHub (Feb 11, 2020):
Running into the same issue here.
@khimaros commented on GitHub (Feb 11, 2020):
Related: https://github.com/dani-garcia/bitwarden_rs/issues/317
@jjlin commented on GitHub (Feb 11, 2020):
And as mentioned in #317, there's no reason to expect this configuration to work properly. #317 is actually an even worse idea because you'd be sending your master password unhashed, making it vulnerable to interception if the system running the proxy were compromised.
@Zuendapp commented on GitHub (Feb 12, 2020):
Hi,
my problem is, that there's no way to implement a client certificate in the iOS App.
The only way the secure the Bitwarden Webserver somewhat is in my opinion in first instance a client certificate or the second solution with basic auth. For me it's not secure enough only with the rocket webserver.
What you think about?
Thank you very much!
@jjlin commented on GitHub (Feb 12, 2020):
Basic auth support is mainly a client-side issue, and probably isn't ever going to work in the official apps.
One of the main premises of the Bitwarden design is that the server doesn't store anything important in unencrypted form, so even if it were compromised, your data is still reasonably secure. If this isn't good enough, the most practical options I can think of are:
your.host.com/<secret>, where<secret>stands in for a basic auth password. Note that the secret path component would be TLS-encrypted. Another somewhat less secure option is to use<secret>.host.com. This form is observable by someone who can monitor your traffic, at least until ESNI becomes widely used.@Zuendapp commented on GitHub (Feb 16, 2020):
@jjlin
Thank you very much! This is really an option but I tried it over days and it's not working properly.
Other users failed also. See #767 #241
BR
@jjlin commented on GitHub (Feb 19, 2020):
@Zuendapp If you're willing to rebuild the backend, feel free to give #868 a try. There are some docs as well.
@Zuendapp commented on GitHub (Feb 20, 2020):
@jjlin
Thank you very much for your work!
Works fine!!
BR
@jjlin commented on GitHub (Feb 20, 2020):
@Zuendapp Thanks for testing. Did you try just the backend, or the web vault as well?
@dani-garcia commented on GitHub (May 13, 2020):
Closed due to inactivity.