The bitwarden desktop app is at a file:// URL, so the frame-ancestors list prevents it from being framed.
This prevents the 2FA webauthn frame from working.
Refused to frame 'https://bitwarden.***/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://*".
The current content-security-policy used by the official web vault at https://vault.bitwarden.com doesn't set frame-ancestors.
Repro steps
Set up 2FA with a yubikey on the web vault
Install the official bitwarden desktop app
Try to sign in with yubikey, sit at loading spinner forever and get Refused to frame ... error in developer tools
Originally created by @LunNova on GitHub (Jun 29, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2585
The bitwarden desktop app is at a file:// URL, so the frame-ancestors list prevents it from being framed.
This prevents the 2FA webauthn frame from working.
```
Refused to frame 'https://bitwarden.***/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://*".
```
```
window.location
Location {ancestorOrigins: DOMStringList, href: 'file:///%LOCALAPPDATA%/Programs/Bitwarden/resources/app.asar/index.html#/login', origin: 'file://', protocol: 'file:', host: '', …}
```
Is it safe to add `file://*` to the [frame-ancestors list in util.rs](https://github.com/dani-garcia/vaultwarden/blob/main/src/util.rs#L73)?
The current content-security-policy used by the official web vault at https://vault.bitwarden.com doesn't set frame-ancestors.
Repro steps
1. Set up 2FA with a yubikey on the web vault
2. Install the official bitwarden desktop app
3. Try to sign in with yubikey, sit at loading spinner forever and get `Refused to frame ...` error in developer tools
Vaultwarden also isn't sending the CSP headers for the connectors/mfa/2fa files served in some of the latter commits
Which version are you using of Vaultwarden? And did you tried the testing tagged image and see if that solved it?
<!-- gh-comment-id:1170502080 -->
@BlackDex commented on GitHub (Jun 29, 2022):
Vaultwarden also isn't sending the CSP headers for the connectors/mfa/2fa files served in some of the latter commits
Which version are you using of Vaultwarden? And did you tried the `testing` tagged image and see if that solved it?
It's working on testing, wasn't on 1.25.0, looks like 5d05ec58be was the fix.
Sorry for the duplicate issue!
<!-- gh-comment-id:1170525790 -->
@LunNova commented on GitHub (Jun 29, 2022):
It's working on `testing`, wasn't on `1.25.0`, looks like 5d05ec58be9e6dcb028d69a428 was the fix.
Sorry for the duplicate issue!
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @LunNova on GitHub (Jun 29, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2585
The bitwarden desktop app is at a file:// URL, so the frame-ancestors list prevents it from being framed.
This prevents the 2FA webauthn frame from working.
Is it safe to add
file://*to the frame-ancestors list in util.rs?The current content-security-policy used by the official web vault at https://vault.bitwarden.com doesn't set frame-ancestors.
Repro steps
Refused to frame ...error in developer tools@BlackDex commented on GitHub (Jun 29, 2022):
Vaultwarden also isn't sending the CSP headers for the connectors/mfa/2fa files served in some of the latter commits
Which version are you using of Vaultwarden? And did you tried the
testingtagged image and see if that solved it?@LunNova commented on GitHub (Jun 29, 2022):
It's working on
testing, wasn't on1.25.0, looks like5d05ec58bewas the fix.Sorry for the duplicate issue!
@BlackDex commented on GitHub (Jun 29, 2022):
No prob. Glad it works with that fix 🙂