mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-05-23 08:32:45 -05:00
[GH-ISSUE #6592] iOS signup fails: emailVerificationToken is JSON-double-quoted causing “Error decoding JWT” in /identity/accounts/register/finish #19246
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @p-boenisch on GitHub (Dec 25, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6592
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN
Config:
Vaultwarden Build Version
v1.34.3
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
OPNSsense HAProxy 3.0.12-21a355d
Host/Server Operating System
Linux
Operating System Version
iOS 18.5
Clients
iOS
Client Version
2025.12.0 (2787)
Steps To Reproduce
signups_allowed=true)./identity/accounts/register/send-verification-emailsuccessfully (200)./identity/accounts/register/finishand Vaultwarden returns 400 withError decoding JWT.Expected Result
iOS signup should succeed.
Actual Result
Signup fails at
/identity/accounts/register/finishwithError decoding JWT.Logs
Screenshots or Videos
No response
Additional Context
No response
@BlackDex commented on GitHub (Jan 4, 2026):
Try v1.35.1 and see if that solves the issue, there were some changes in the JWT token stuff if I'm correct.
@stefan0xC commented on GitHub (Jan 5, 2026):
I think this(?) error is also reproducible on Android:
Running latest
testing(1.35.1-bf37657c).btw: I have SMTP configured so I get the mail with the signup link and can finish the registration that way. But if you don't have mail configured I think that this will fail. (I can test that later.)
edit: after looking into it a bit I think this issue is caused because we return 200 with no body
bf37657c08/src/api/identity.rs (L960)and don't return status::NoContent (204 No Content) - have not tested if this fixes the error in android but since this is the behavior of the bitwarden server I think it should. - so this is likely unrelated to the iOS error.update: yep, on Android signing up (if it's allowed and verification is not required) just works, so I can't reproduce the reported error like I initially thought.
@BlackDex commented on GitHub (Jan 5, 2026):
Resolved via #6665
@stefan0xC commented on GitHub (Jan 5, 2026):
@BlackDex the PR just resolved the issue I've noticed. I can't reproduce the initially reported error with iOS (or check if it still occurs) because I don't have an iPhone but that should be if you have not set up mail or don't require email verification, i.e. the opposite of what I had encountered. It might already be resolved but that would not be through my change because you would get a Token
bf37657c08/src/api/identity.rs (L962-L964)@Nicholas-Ho commented on GitHub (Feb 22, 2026):
The error with the iOS client is still present in the current latest (v1.35.3). The error I am getting is
Error decoding JWT: Invalid Byte(0, 34)during initial signup when trying to hit the/identity/accounts/register/finish. Haven't had the chance to capture the request itself but it seems to be the same error found by @p-boenischThis is unrelated to the error identified by @stefan0xC and is not solved by PR #6665. @BlackDex could we reopen this issue?
Edit: raising slight differences in my setup, mainly the use of a Caddy reverse proxy, set up as per the wiki example
@BlackDex commented on GitHub (Feb 22, 2026):
Please try to use the Flight Recorder first, and see what the actual error is before opening a new issue.
Also, for most client side item we suggest to start a discussion first instead of an issue and provide detailed information like the Support String, and if possible the output of the Flight Recorder during this error.