FIDO2 2FA not working when using reverse proxy #5082

New Issue

2026-03-07T20:12:27-06:00

GiteaMirror commented

2026-03-07 20:12:27 -06:00

Originally created by @Anonym234 on GitHub (Dec 20, 2022).

I use the vaultwarden/server docker container behind a nginx-based reverse proxy. The connection between nginx and the vaultwarden docker container is via http (nginx redirects to http://localhost:<some port>) and my docker-compose config redirects port to port 80 in the vaultwarden container.

When I log in, the browser extension or website asks for my 2FA and displays an error message, saying that this operation is not allowed.

Originally created by @Anonym234 on GitHub (Dec 20, 2022). I use the vaultwarden/server docker container behind a nginx-based reverse proxy. The connection between nginx and the vaultwarden docker container is via http (nginx redirects to `http://localhost:<some port>`) and my docker-compose config redirects port <some port> to port 80 in the vaultwarden container. When I log in, the browser extension or website asks for my 2FA and displays an error message, saying that this operation is not allowed.

GiteaMirror closed this issue

2026-03-07 20:12:28 -06:00

GiteaMirror commented

2026-03-07 20:12:28 -06:00

@BlackDex commented on GitHub (Dec 20, 2022):

Then your nginx added or modified some security headers which prevents a good working environment.

Headers like Content-Security-Policy or X-Frame-Options should not be altered, or in some cases not even sent, like for the popup screens used for mfa, because, else they are blocked.

Also, the DOMAIN needs to be configured correctly, else that will cause issues too.
And you need https if it is not localhost or 127.0.0.1.

@BlackDex commented on GitHub (Dec 20, 2022): Then your nginx added or modified some security headers which prevents a good working environment. Headers like `Content-Security-Policy` or `X-Frame-Options` should not be altered, or in some cases not even sent, like for the popup screens used for mfa, because, else they are blocked. Also, the DOMAIN needs to be configured correctly, else that will cause issues too. And you need https if it is not `localhost` or `127.0.0.1`.

GiteaMirror referenced this issue

2026-03-07 21:12:41 -06:00

[PR #5082] [MERGED] Fix field type to actually be hidden #7196

GiteaMirror referenced this issue

2026-04-16 12:27:47 -05:00

[PR #5082] [MERGED] Fix field type to actually be hidden #8496

GiteaMirror referenced this issue

2026-04-20 15:44:18 -05:00

[PR #5082] [MERGED] Fix field type to actually be hidden #12422

GiteaMirror referenced this issue

2026-04-23 07:51:38 -05:00

[PR #5082] [MERGED] Fix field type to actually be hidden #16402