Serve /.well-known/apple-app-site-association from vaultwarden.
Right now the request falls through to the web vault catch-all route:
#[get("/<p..>", rank = 10)]
That route takes a PathBuf, and Rocket rejects .well-known before the static file lookup runs. The result is a 422 Unprocessable Entity instead of an AASA response.
Changes
Add an explicit GET /.well-known/apple-app-site-association route before the catch-all web vault route.
Return JSON with Content-Type: application/json.
Use the current Bitwarden iOS app identifiers:
LTZ2PFU5D6.com.8bit.bitwarden
LTZ2PFU5D6.com.8bit.bitwarden.beta
Notes
I'm keeping this scoped to the server-side endpoint. This fixes the 422 response for the AASA URL, but it does not claim to fully solve every iOS passkey/auth-loop case by itself.
Verification
I checked the route behavior with a minimal Rocket reproduction using the same catch-all route shape.
Before adding an explicit route:
GET /.well-known/apple-app-site-association
PathBuf guard forwards with BadStart('.')
status: 422 Unprocessable Entity
After adding the explicit route:
GET /.well-known/apple-app-site-association
status: 200 OK
content-type: application/json
I also ran:
cargo fmt --all -- --check
git diff --check
Finally, I ran the repository CI on my fork for commit 399742b; all checks passed:
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/7191
**Author:** [@user71424q](https://github.com/user71424q)
**Created:** 5/5/2026
**Status:** ✅ Merged
**Merged:** 5/17/2026
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `fix/apple-app-site-association`
---
### 📝 Commits (1)
- [`399742b`](https://github.com/dani-garcia/vaultwarden/commit/399742be5e333c07fb139f0df0efb70b325f7baf) Serve Apple app site association file
### 📊 Changes
**1 file changed** (+27 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `src/api/web.rs` (+27 -1)
</details>
### 📄 Description
## Summary
Serve `/.well-known/apple-app-site-association` from vaultwarden.
Right now the request falls through to the web vault catch-all route:
```rust
#[get("/<p..>", rank = 10)]
```
That route takes a `PathBuf`, and Rocket rejects `.well-known` before the static file lookup runs. The result is a `422 Unprocessable Entity` instead of an AASA response.
## Changes
- Add an explicit `GET /.well-known/apple-app-site-association` route before the catch-all web vault route.
- Return JSON with `Content-Type: application/json`.
- Use the current Bitwarden iOS app identifiers:
- `LTZ2PFU5D6.com.8bit.bitwarden`
- `LTZ2PFU5D6.com.8bit.bitwarden.beta`
## Notes
I'm keeping this scoped to the server-side endpoint. This fixes the `422` response for the AASA URL, but it does not claim to fully solve every iOS passkey/auth-loop case by itself.
## Verification
I checked the route behavior with a minimal Rocket reproduction using the same catch-all route shape.
Before adding an explicit route:
```text
GET /.well-known/apple-app-site-association
PathBuf guard forwards with BadStart('.')
status: 422 Unprocessable Entity
```
After adding the explicit route:
```text
GET /.well-known/apple-app-site-association
status: 200 OK
content-type: application/json
```
I also ran:
```text
cargo fmt --all -- --check
git diff --check
```
Finally, I ran the repository CI on my fork for commit `399742b`; all checks passed:
- Build and Test / msrv
- Build and Test / rust-toolchain
- Code Spell Checking
- Hadolint
- Check templates
- zizmor
Refs #7186
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror
changed title from [PR #7191] Serve Apple app site association file to [PR #7191] [MERGED] Serve Apple app site association file2026-05-22 02:25:55 -05:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/7191
Author: @user71424q
Created: 5/5/2026
Status: ✅ Merged
Merged: 5/17/2026
Merged by: @dani-garcia
Base:
main← Head:fix/apple-app-site-association📝 Commits (1)
399742bServe Apple app site association file📊 Changes
1 file changed (+27 additions, -1 deletions)
View changed files
📝
src/api/web.rs(+27 -1)📄 Description
Summary
Serve
/.well-known/apple-app-site-associationfrom vaultwarden.Right now the request falls through to the web vault catch-all route:
That route takes a
PathBuf, and Rocket rejects.well-knownbefore the static file lookup runs. The result is a422 Unprocessable Entityinstead of an AASA response.Changes
GET /.well-known/apple-app-site-associationroute before the catch-all web vault route.Content-Type: application/json.LTZ2PFU5D6.com.8bit.bitwardenLTZ2PFU5D6.com.8bit.bitwarden.betaNotes
I'm keeping this scoped to the server-side endpoint. This fixes the
422response for the AASA URL, but it does not claim to fully solve every iOS passkey/auth-loop case by itself.Verification
I checked the route behavior with a minimal Rocket reproduction using the same catch-all route shape.
Before adding an explicit route:
After adding the explicit route:
I also ran:
Finally, I ran the repository CI on my fork for commit
399742b; all checks passed:Refs #7186
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
[PR #7191] Serve Apple app site association fileto [PR #7191] [MERGED] Serve Apple app site association file