github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-08-07 08:16:41 -05:00
Code Issues 534 Packages Projects Releases 85 Wiki Activity

[GH-ISSUE #4042] Unable to Deauthorize sessions #34711

New Issue
Closed
opened 2026-07-13 19:24:57 -05:00 by GiteaMirror · 9 comments
GiteaMirror commented 2026-07-13 19:24:57 -05:00
Owner
Copy Link
Copy Source

Originally created by @MButcho on GitHub (Nov 6, 2023).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4042

Subject of the issue

When I try to Deauthorize sessions, I receive following error:
image

The reason is I wanted to implement push notifications, which are not working

Deployment environment

  • vaultwarden version :v1.30.0

  • Install method: Docker image

  • Clients used: web vault, desktop, iOS

  • Reverse proxy and version: nginx version: nginx/1.18.0 (Ubuntu)

  • Nginx config:

http {
    upstream vaultwarden-default {
    zone vaultwarden-default 64k;
    server 127.0.0.1:8088;
    keepalive 2;
  }
  
  upstream vaultwarden-ws {
    zone vaultwarden-ws 64k;
    server 127.0.0.1:3012;
    keepalive 2;
  }

  server {
    server_name some.domain.com;
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    
    client_max_body_size 128M;

    location / {
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_pass http://vaultwarden-default;
    }

    location /notifications/hub/negotiate {
      proxy_http_version 1.1;
      proxy_set_header "Connection" "";

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_pass http://vaultwarden-default;
    }

    location /notifications/hub {
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Forwarded $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_pass http://vaultwarden-ws;
    }

    # Optionally add extra authentication besides the ADMIN_TOKEN
    # Remove the comments below `#` and create the htpasswd_file to have it active
    #
    #location /admin {
    #  # See: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/
    #  auth_basic "Private";
    #  auth_basic_user_file /path/to/htpasswd_file;
    #
    #  proxy_http_version 1.1;
    #  proxy_set_header "Connection" "";
    #
    #  proxy_set_header Host $host;
    #  proxy_set_header X-Real-IP $remote_addr;
    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #  proxy_set_header X-Forwarded-Proto $scheme;
    #
    #  proxy_pass http://vaultwarden-default;
    #}
    
    listen 443 ssl; # managed by Certbot
    ...
  }

Steps to reproduce

Log into web account / Account Settings / My Account / Deauthorize sessions / Send Code

Expected behaviour

Send email to confirm sessions deauthorize

Actual behaviour

Error above

Troubleshooting data

Log:
[2023-11-06 20:21:16.316][request][INFO] POST /api/accounts/request-otp
[2023-11-06 20:21:16.316][response][INFO] 404 Not Found

Originally created by @MButcho on GitHub (Nov 6, 2023). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4042 ### Subject of the issue When I try to Deauthorize sessions, I receive following error: ![image](https://github.com/dani-garcia/vaultwarden/assets/41790777/130be9b0-4b92-40b5-8af5-80fa7a77fbab) The reason is I wanted to implement push notifications, which are not working ### Deployment environment * vaultwarden version :v1.30.0 * Install method: Docker image * Clients used: web vault, desktop, iOS * Reverse proxy and version: nginx version: nginx/1.18.0 (Ubuntu) * Nginx config: ``` http { upstream vaultwarden-default { zone vaultwarden-default 64k; server 127.0.0.1:8088; keepalive 2; } upstream vaultwarden-ws { zone vaultwarden-ws 64k; server 127.0.0.1:3012; keepalive 2; } server { server_name some.domain.com; access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; client_max_body_size 128M; location / { proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://vaultwarden-default; } location /notifications/hub/negotiate { proxy_http_version 1.1; proxy_set_header "Connection" ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://vaultwarden-default; } location /notifications/hub { proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Forwarded $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://vaultwarden-ws; } # Optionally add extra authentication besides the ADMIN_TOKEN # Remove the comments below `#` and create the htpasswd_file to have it active # #location /admin { # # See: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/ # auth_basic "Private"; # auth_basic_user_file /path/to/htpasswd_file; # # proxy_http_version 1.1; # proxy_set_header "Connection" ""; # # proxy_set_header Host $host; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Forwarded-Proto $scheme; # # proxy_pass http://vaultwarden-default; #} listen 443 ssl; # managed by Certbot ... } ``` ### Steps to reproduce Log into web account / Account Settings / My Account / Deauthorize sessions / Send Code ### Expected behaviour Send email to confirm sessions deauthorize ### Actual behaviour Error above ### Troubleshooting data Log: [2023-11-06 20:21:16.316][request][INFO] POST /api/accounts/request-otp [2023-11-06 20:21:16.316][response][INFO] 404 Not Found
GiteaMirror added the enhancementbug labels 2026-07-13 19:24:58 -05:00
GiteaMirror commented 2026-07-13 19:25:00 -05:00
Author
Owner
Copy Link
Copy Source

@MButcho commented on GitHub (Nov 6, 2023):

Other actions that require OTP have the same issue, like exporting vault

<!-- gh-comment-id:1796417593 --> @MButcho commented on GitHub (Nov 6, 2023): Other actions that require OTP have the same issue, like exporting vault
GiteaMirror commented 2026-07-13 19:25:01 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 6, 2023):

Seems this only gets triggered when using Login With Device i think when looking at the Bitwarden client code.

Can you confirm this?

<!-- gh-comment-id:1796432734 --> @BlackDex commented on GitHub (Nov 6, 2023): Seems this only gets triggered when using `Login With Device` i think when looking at the Bitwarden client code. Can you confirm this?
GiteaMirror commented 2026-07-13 19:25:01 -05:00
Author
Owner
Copy Link
Copy Source

@MButcho commented on GitHub (Nov 6, 2023):

Correct, when using master password to log in, the export and deauthorize is possible

<!-- gh-comment-id:1796490635 --> @MButcho commented on GitHub (Nov 6, 2023): Correct, when using master password to log in, the export and deauthorize is possible
GiteaMirror commented 2026-07-13 19:25:02 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 6, 2023):

Great thanks!

<!-- gh-comment-id:1796500805 --> @BlackDex commented on GitHub (Nov 6, 2023): Great thanks!
GiteaMirror commented 2026-07-13 19:25:02 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 6, 2023):

Also, i would suggest to update your nginx config to not use port 3012 anymore, and remove those locations. Also, sending Connect: Upgrade all the time is probably not good.

Check the https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples for more details.

<!-- gh-comment-id:1796512036 --> @BlackDex commented on GitHub (Nov 6, 2023): Also, i would suggest to update your nginx config to not use port 3012 anymore, and remove those locations. Also, sending `Connect: Upgrade` all the time is probably not good. Check the https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples for more details.
GiteaMirror commented 2026-07-13 19:25:03 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 7, 2023):

I'm able to reproduce this, so now to find the correct solution to fix this.

<!-- gh-comment-id:1799069264 --> @BlackDex commented on GitHub (Nov 7, 2023): I'm able to reproduce this, so now to find the correct solution to fix this.
GiteaMirror commented 2026-07-13 19:25:03 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 7, 2023):

Ok, it looks like this needs SMTP to be enabled.
Without this, you can't export, deauthorize, and maybe more specific items, like purge vault etc..

With this feature a mail will be sent with a passcode which enables you to verify you are you when you used Login with device which was unlocked via either PIN or Biometrics.

<!-- gh-comment-id:1799139454 --> @BlackDex commented on GitHub (Nov 7, 2023): Ok, it looks like this needs SMTP to be enabled. Without this, you can't export, deauthorize, and maybe more specific items, like purge vault etc.. With this feature a mail will be sent with a passcode which enables you to verify you are you when you used `Login with device` which was unlocked via either PIN or Biometrics.
GiteaMirror commented 2026-07-13 19:25:04 -05:00
Author
Owner
Copy Link
Copy Source

@kqmaverick commented on GitHub (Nov 7, 2023):

I have SMTP enabled and still see this error.

<!-- gh-comment-id:1800431226 --> @kqmaverick commented on GitHub (Nov 7, 2023): I have SMTP enabled and still see this error.
GiteaMirror commented 2026-07-13 19:25:05 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 8, 2023):

I have SMTP enabled and still see this error.

That is correct, since the endpoints which are called are not supported by Vaultwarden.

But there could be people who do not have SMTP enabled for which this could be an issue.

Only way they can bypass is to login without an other device.

<!-- gh-comment-id:1801124603 --> @BlackDex commented on GitHub (Nov 8, 2023): > I have SMTP enabled and still see this error. That is correct, since the endpoints which are called are not supported by Vaultwarden. But there could be people who do not have SMTP enabled for which this could be an issue. Only way they can bypass is to login without an other device.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No labels bug enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#34711