This PR make multiple modifications to the authentication flow:
stop wrapping the returned values from the authorization (code or error) in a JWT token to pass through Bitwarden redirection. Instead, it stores them in database and use the state to find them again.
The length of the JWT Token might have been causing issue with the desktop client and Chrome on Windows.
stop using a memory cache to store the User information in case a 2FA flow is triggered, use the database that we were reading anyway.
Validate the Bitwarden clients PKCE code challenge to ensure that the client exchanging the code is the one which initiated the request (Either pass it to the provider or check it before calling it).
Documentation which could be added to the wiki:
Login Flow
On SSO_PKCE
When activated the Bitwarden Clients PKCE code challenge are passed to the provider.
If disabled PKCE validation is still done before exchanging the code.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6205
**Author:** [@Timshel](https://github.com/Timshel)
**Created:** 8/20/2025
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `features/sso-db-code`
---
### 📝 Commits (1)
- [`30550db`](https://github.com/dani-garcia/vaultwarden/commit/30550db3353dd39773e0e64ecd03a3e186c23a44) Improve sso auth flow
### 📊 Changes
**17 files changed** (+448 additions, -295 deletions)
<details>
<summary>View changed files</summary>
📝 `.env.template` (+2 -2)
➕ `migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/down.sql` (+9 -0)
➕ `migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/up.sql` (+12 -0)
➕ `migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/down.sql` (+9 -0)
➕ `migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/up.sql` (+12 -0)
➕ `migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/down.sql` (+9 -0)
➕ `migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/up.sql` (+12 -0)
📝 `src/api/identity.rs` (+53 -55)
📝 `src/config.rs` (+2 -2)
📝 `src/db/mod.rs` (+40 -0)
📝 `src/db/models/mod.rs` (+2 -2)
➕ `src/db/models/sso_auth.rs` (+134 -0)
➖ `src/db/models/sso_nonce.rs` (+0 -87)
📝 `src/db/schema.rs` (+5 -2)
📝 `src/main.rs` (+4 -4)
📝 `src/sso.rs` (+120 -125)
📝 `src/sso_client.rs` (+23 -16)
</details>
### 📄 Description
This PR make multiple modifications to the authentication flow:
- stop wrapping the returned values from the authorization (`code` or `error`) in a JWT token to pass through Bitwarden redirection. Instead, it stores them in database and use the `state` to find them again.
The length of the JWT Token might have been causing issue with the desktop client and Chrome on Windows.
- stop using a memory cache to store the User information in case a 2FA flow is triggered, use the database that we were reading anyway.
- Validate the Bitwarden clients PKCE code challenge to ensure that the client exchanging the `code` is the one which initiated the request (Either pass it to the provider or check it before calling it).
-------
Documentation which could be added to the wiki:
## Login Flow
### On `SSO_PKCE`
When activated the Bitwarden Clients PKCE code challenge are passed to the provider.
If disabled PKCE validation is still done before exchanging the code.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6205
Author: @Timshel
Created: 8/20/2025
Status: 🔄 Open
Base:
main← Head:features/sso-db-code📝 Commits (1)
30550dbImprove sso auth flow📊 Changes
17 files changed (+448 additions, -295 deletions)
View changed files
📝
.env.template(+2 -2)➕
migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/down.sql(+9 -0)➕
migrations/mysql/2025-08-20-120000_sso_nonce_to_auth/up.sql(+12 -0)➕
migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/down.sql(+9 -0)➕
migrations/postgresql/2025-08-20-120000_sso_nonce_to_auth/up.sql(+12 -0)➕
migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/down.sql(+9 -0)➕
migrations/sqlite/2025-08-20-120000_sso_nonce_to_auth/up.sql(+12 -0)📝
src/api/identity.rs(+53 -55)📝
src/config.rs(+2 -2)📝
src/db/mod.rs(+40 -0)📝
src/db/models/mod.rs(+2 -2)➕
src/db/models/sso_auth.rs(+134 -0)➖
src/db/models/sso_nonce.rs(+0 -87)📝
src/db/schema.rs(+5 -2)📝
src/main.rs(+4 -4)📝
src/sso.rs(+120 -125)📝
src/sso_client.rs(+23 -16)📄 Description
This PR make multiple modifications to the authentication flow:
codeorerror) in a JWT token to pass through Bitwarden redirection. Instead, it stores them in database and use thestateto find them again.The length of the JWT Token might have been causing issue with the desktop client and Chrome on Windows.
codeis the one which initiated the request (Either pass it to the provider or check it before calling it).Documentation which could be added to the wiki:
Login Flow
On
SSO_PKCEWhen activated the Bitwarden Clients PKCE code challenge are passed to the provider.
If disabled PKCE validation is still done before exchanging the code.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.