Sometimes on trying to send a 2FA-Mail, the SMTP Server replies with 454: 4.7.0 Temporary authentication failure, which should indicate to the sender "please try later, this is a temporary problem". However vaultwarden panics if it receives this error and the server stops.
Deployment environment
vaultwarden version: 1.30.3
Install method: FreeBSD pkg
Clients used: happens on all clients on Login
Reverse proxy and version: nginx
Other relevant details:
Expected behaviour
Server does not crash if it receives a temporary SMTP-Failure.
Actual behaviour
Server crashes and needs restarting.
Troubleshooting data
Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.251][vaultwarden::mail][ERROR] SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server
Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.252][panic][ERROR] thread 'tokio-runtime-worker' panicked at 'Error sending incomplete 2FA email: SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server': src/api/core/two_factor/mod.rs:273
Originally created by @Subito on GitHub (Apr 29, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4528
<!--
# ###
NOTE: Please update to the latest version of vaultwarden before reporting an issue!
This saves you and us a lot of time and troubleshooting.
See:
* https://github.com/dani-garcia/vaultwarden/issues/1180
* https://github.com/dani-garcia/vaultwarden/wiki/Updating-the-vaultwarden-image
# ###
-->
<!--
Please fill out the following template to make solving your problem easier and faster for us.
This is only a guideline. If you think that parts are unnecessary for your issue, feel free to remove them.
Remember to hide/redact personal or confidential information,
such as passwords, IP addresses, and DNS names as appropriate.
-->
### Subject of the issue
<!-- Describe your issue here. -->
Sometimes on trying to send a 2FA-Mail, the SMTP Server replies with `454: 4.7.0 Temporary authentication failure`, which should indicate to the sender "please try later, this is a temporary problem". However vaultwarden panics if it receives this error and the server stops.
### Deployment environment
<!--
=========================================================================================
Preferably, use the `Generate Support String` button on the admin page's Diagnostics tab.
That will auto-generate most of the info requested in this section.
=========================================================================================
-->
<!-- The version number, obtained from the logs (at startup) or the admin diagnostics page -->
<!-- This is NOT the version number shown on the web vault, which is versioned separately from vaultwarden -->
<!-- Remember to check if your issue exists on the latest version first! -->
* vaultwarden version: 1.30.3
<!-- How the server was installed: Docker image, OS package, built from source, etc. -->
* Install method: FreeBSD pkg
* Clients used: happens on all clients on Login <!-- web vault, desktop, Android, iOS, etc. (if applicable) -->
* Reverse proxy and version: nginx <!-- if applicable -->
* Other relevant details:
### Expected behaviour
<!-- Tell us what you expected to happen -->
Server does not crash if it receives a temporary SMTP-Failure.
### Actual behaviour
<!-- Tell us what actually happened -->
Server crashes and needs restarting.
### Troubleshooting data
```
Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.251][vaultwarden::mail][ERROR] SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server
Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.252][panic][ERROR] thread 'tokio-runtime-worker' panicked at 'Error sending incomplete 2FA email: SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server': src/api/core/two_factor/mod.rs:273
```
GiteaMirror
added the bug label 2026-04-20 14:08:30 -05:00
Vaultwarden does not have a retry mechanisch for these kind of scenarios. The message indicates a connection error.
Most of the time temp errors should be tried again after a few minutes, but this is not something Vaultwarden handles. I also do not thing Vaultwarden should handle those and try again actually. That kind of functionality belongs to mail servers, not clients.
We probably can catch this error and return an error instead of a panic though, that is probably nicer then a panic.
<!-- gh-comment-id:2083569863 -->
@BlackDex commented on GitHub (Apr 29, 2024):
Vaultwarden does not have a retry mechanisch for these kind of scenarios. The message indicates a connection error.
Most of the time temp errors should be tried again after a few minutes, but this is not something Vaultwarden handles. I also do not thing Vaultwarden should handle those and try again actually. That kind of functionality belongs to mail servers, not clients.
We probably can catch this error and return an error instead of a panic though, that is probably nicer then a panic.
Of course, just catching the error would be great. As you said: Any sort of queue-and-retry should be handled on a mailserver. But panicing on a simple SMTP-Error is probably not great. Just logging an error would be perfect.
<!-- gh-comment-id:2084480234 -->
@Subito commented on GitHub (Apr 30, 2024):
Of course, just catching the error would be great. As you said: Any sort of queue-and-retry should be handled on a mailserver. But panicing on a simple SMTP-Error is probably not great. Just logging an error would be perfect.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @Subito on GitHub (Apr 29, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4528
Subject of the issue
Sometimes on trying to send a 2FA-Mail, the SMTP Server replies with
454: 4.7.0 Temporary authentication failure, which should indicate to the sender "please try later, this is a temporary problem". However vaultwarden panics if it receives this error and the server stops.Deployment environment
Install method: FreeBSD pkg
Clients used: happens on all clients on Login
Reverse proxy and version: nginx
Other relevant details:
Expected behaviour
Server does not crash if it receives a temporary SMTP-Failure.
Actual behaviour
Server crashes and needs restarting.
Troubleshooting data
@BlackDex commented on GitHub (Apr 29, 2024):
Vaultwarden does not have a retry mechanisch for these kind of scenarios. The message indicates a connection error.
Most of the time temp errors should be tried again after a few minutes, but this is not something Vaultwarden handles. I also do not thing Vaultwarden should handle those and try again actually. That kind of functionality belongs to mail servers, not clients.
We probably can catch this error and return an error instead of a panic though, that is probably nicer then a panic.
@Subito commented on GitHub (Apr 30, 2024):
Of course, just catching the error would be great. As you said: Any sort of queue-and-retry should be handled on a mailserver. But panicing on a simple SMTP-Error is probably not great. Just logging an error would be perfect.