This kind of sucks. I was hoping to make it work so the whole thing is idiot proof.
I guess friends and family will still have to type their master password at least once, and will still have to remember some sort of pin at the very least, for unlocking the extension, but at least this eliminates the need for typing the master password multiple times during new device registration for example.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/7034
**Author:** [@rwjack](https://github.com/rwjack)
**Created:** 3/29/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `main`
---
### 📝 Commits (2)
- [`c760e63`](https://github.com/dani-garcia/vaultwarden/commit/c760e63a9be9b30bd15296baef0fc3fa285ac56b) add trusted device verification: https://github.com/dani-garcia/vaultwarden/discussions/6655
- [`bec8ce5`](https://github.com/dani-garcia/vaultwarden/commit/bec8ce533157e9e03a9f1fb3032638b42df7eb23) revert cors
### 📊 Changes
**20 files changed** (+385 additions, -75 deletions)
<details>
<summary>View changed files</summary>
📝 `.env.template` (+2 -0)
➕ `migrations/mysql/2026-03-29-120000_add_device_trusted_encryption/down.sql` (+4 -0)
➕ `migrations/mysql/2026-03-29-120000_add_device_trusted_encryption/up.sql` (+4 -0)
➕ `migrations/postgresql/2026-03-29-120000_add_device_trusted_encryption/down.sql` (+4 -0)
➕ `migrations/postgresql/2026-03-29-120000_add_device_trusted_encryption/up.sql` (+4 -0)
➕ `migrations/sqlite/2026-03-29-120000_add_device_trusted_encryption/down.sql` (+0 -0)
➕ `migrations/sqlite/2026-03-29-120000_add_device_trusted_encryption/up.sql` (+3 -0)
📝 `playwright/docker-compose.yml` (+1 -0)
➕ `playwright/tests/sso_trusted_device.spec.ts` (+26 -0)
📝 `src/api/core/accounts.rs` (+49 -0)
📝 `src/api/core/ciphers.rs` (+2 -23)
📝 `src/api/core/sends.rs` (+3 -0)
📝 `src/api/identity.rs` (+9 -48)
📝 `src/api/mod.rs` (+1 -0)
➕ `src/api/user_decryption.rs` (+218 -0)
📝 `src/config.rs` (+2 -0)
📝 `src/db/models/device.rs` (+31 -4)
📝 `src/db/models/user.rs` (+9 -0)
📝 `src/db/schema.rs` (+3 -0)
📝 `src/main.rs` (+10 -0)
</details>
### 📄 Description
This kind of sucks. I was hoping to make it work so the whole thing is idiot proof.
I guess friends and family will still have to type their master password at least once, and will still have to remember some sort of pin at the very least, for unlocking the extension, but at least this eliminates the need for typing the master password multiple times during new device registration for example.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/7034
Author: @rwjack
Created: 3/29/2026
Status: 🔄 Open
Base:
main← Head:main📝 Commits (2)
c760e63add trusted device verification: https://github.com/dani-garcia/vaultwarden/discussions/6655bec8ce5revert cors📊 Changes
20 files changed (+385 additions, -75 deletions)
View changed files
📝
.env.template(+2 -0)➕
migrations/mysql/2026-03-29-120000_add_device_trusted_encryption/down.sql(+4 -0)➕
migrations/mysql/2026-03-29-120000_add_device_trusted_encryption/up.sql(+4 -0)➕
migrations/postgresql/2026-03-29-120000_add_device_trusted_encryption/down.sql(+4 -0)➕
migrations/postgresql/2026-03-29-120000_add_device_trusted_encryption/up.sql(+4 -0)➕
migrations/sqlite/2026-03-29-120000_add_device_trusted_encryption/down.sql(+0 -0)➕
migrations/sqlite/2026-03-29-120000_add_device_trusted_encryption/up.sql(+3 -0)📝
playwright/docker-compose.yml(+1 -0)➕
playwright/tests/sso_trusted_device.spec.ts(+26 -0)📝
src/api/core/accounts.rs(+49 -0)📝
src/api/core/ciphers.rs(+2 -23)📝
src/api/core/sends.rs(+3 -0)📝
src/api/identity.rs(+9 -48)📝
src/api/mod.rs(+1 -0)➕
src/api/user_decryption.rs(+218 -0)📝
src/config.rs(+2 -0)📝
src/db/models/device.rs(+31 -4)📝
src/db/models/user.rs(+9 -0)📝
src/db/schema.rs(+3 -0)📝
src/main.rs(+10 -0)📄 Description
This kind of sucks. I was hoping to make it work so the whole thing is idiot proof.
I guess friends and family will still have to type their master password at least once, and will still have to remember some sort of pin at the very least, for unlocking the extension, but at least this eliminates the need for typing the master password multiple times during new device registration for example.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.