[GH-ISSUE #4858] DUO redirection after 2FA does not redirect to the subpath with 1.32.0 #29494

New Issue

Closed

opened 2026-06-17 09:06:34 -05:00 by GiteaMirror · 1 comment

GiteaMirror commented 2026-06-17 09:06:34 -05:00

Owner

Copy Link

Copy Source

Originally created by @kilaketia on GitHub (Aug 14, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4858

Subject of the issue

After 2FA verification is done, DUO redirect us to https://fqdn/duo-redirect-connector.html instead of https://fqdn/subpath/duo-redirect-connector.html.

Deployment environment

• vaultwarden version: 1.32.0

• Install method: Docker

• Clients used: web vault

• Reverse proxy and version: NGINX 1.22.1-9

• MySQL/MariaDB or PostgreSQL version: MariaDB

• Other relevant details:

Steps to reproduce

Try to login with DUO 2FA, with Vaultwarden accessible from a sub path only, using the old interface or the universal prompt of DUO.

Expected behaviour

User should be redirected to https://fqdn/subpath/duo-redirect-connector.html after 2FA verification with DUO.

Actual behaviour

User is redirected to https://fqdn/duo-redirect-connector.html and receive a 404 error.

Troubleshooting data

Vaultwarden is configured with domain as "https://fqdn/vault/".

NGINX configuration :

upstream vaultwarden-default {
  zone vaultwarden-default 64k;
  server 127.0.0.1:8080;
  keepalive 2;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      "";
}

server {
        listen 443 ssl http2;
        server_name vault.mydomain.com;
        ssl_certificate /etc/ssl/private/cert.pem;
        ssl_certificate_key /etc/ssl/private/key.pem;
        client_max_body_size 128M;

        access_log /var/log/nginx/vault.access.log;
        error_log /var/log/nginx/vault.error.log warn;
        add_header X-Robots-Tag "none";

         location /vault/ {
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection $connection_upgrade;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
        	proxy_pass http://vaultwarden-default;
        }

        location /vault/admin {
                allow 192.168.1.0/24;
                deny all;

                proxy_http_version 1.1;
                proxy_set_header "Connection" "";
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_pass http://vaultwarden-default;
        }

        proxy_connect_timeout       777;
        proxy_send_timeout          777;
        proxy_read_timeout          777;
        send_timeout                777;
}

server {
        listen 80;
        server_name vault.mydomain.com;
        return 301 https://$host$request_uri;
}

Temporary fix :

 location / {
                rewrite ^/duo-redirect-connector.html$ /vault/duo-redirect-connector.html?$args permanent;
}

Originally created by @kilaketia on GitHub (Aug 14, 2024). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4858 ### Subject of the issue After 2FA verification is done, DUO redirect us to https://fqdn/duo-redirect-connector.html instead of https://fqdn/subpath/duo-redirect-connector.html. ### Deployment environment * vaultwarden version: 1.32.0 * Install method: Docker * Clients used: web vault * Reverse proxy and version: NGINX 1.22.1-9 * MySQL/MariaDB or PostgreSQL version: MariaDB * Other relevant details: ### Steps to reproduce Try to login with DUO 2FA, with Vaultwarden accessible from a sub path only, using the old interface or the universal prompt of DUO. ### Expected behaviour User should be redirected to https://fqdn/subpath/duo-redirect-connector.html after 2FA verification with DUO. ### Actual behaviour User is redirected to https://fqdn/duo-redirect-connector.html and receive a 404 error. ### Troubleshooting data Vaultwarden is configured with domain as "https://fqdn/vault/". NGINX configuration : ``` upstream vaultwarden-default { zone vaultwarden-default 64k; server 127.0.0.1:8080; keepalive 2; } map $http_upgrade $connection_upgrade { default upgrade; '' ""; } server { listen 443 ssl http2; server_name vault.mydomain.com; ssl_certificate /etc/ssl/private/cert.pem; ssl_certificate_key /etc/ssl/private/key.pem; client_max_body_size 128M; access_log /var/log/nginx/vault.access.log; error_log /var/log/nginx/vault.error.log warn; add_header X-Robots-Tag "none"; location /vault/ { proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://vaultwarden-default; } location /vault/admin { allow 192.168.1.0/24; deny all; proxy_http_version 1.1; proxy_set_header "Connection" ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://vaultwarden-default; } proxy_connect_timeout 777; proxy_send_timeout 777; proxy_read_timeout 777; send_timeout 777; } server { listen 80; server_name vault.mydomain.com; return 301 https://$host$request_uri; } ``` Temporary fix : ``` location / { rewrite ^/duo-redirect-connector.html$ /vault/duo-redirect-connector.html?$args permanent; } ```

GiteaMirror added the bug label 2026-06-17 09:06:34 -05:00

GiteaMirror closed this issue 2026-06-17 09:06:34 -05:00

GiteaMirror commented 2026-06-17 09:06:35 -05:00

Author

Owner

Copy Link

Copy Source

@GeorgeCastanza commented on GitHub (Aug 14, 2024):

I suspect this is my issue too. When I login, the cloudflare tunnel is not redirecting properly (I guess??) and it's forwarding to my router page, not my vw instance.

Edit: login via email code does work.

<!-- gh-comment-id:2290096150 --> @GeorgeCastanza commented on GitHub (Aug 14, 2024): I suspect this is my issue too. When I login, the cloudflare tunnel is not redirecting properly (I guess??) and it's forwarding to my router page, not my vw instance. Edit: login via email code **does** work.

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

various_fixes

revert-7033-patch-1

cached-config-operations

test_dylint

1.36.0

1.35.8

1.35.7

1.35.6

1.35.5

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

wontfix

No labels bug

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

GiteaMirror ninjasurge (Kaehlen Rog)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#29494