[PR #1243] [MERGED] Fix Key Rotation during password change. #6566

New Issue

GiteaMirror · 2026-03-07T21:01:03-06:00

GiteaMirror commented

2026-03-07 21:01:03 -06:00

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/1243
Author: @BlackDex
Created: 11/28/2020
Status: ✅ Merged
Merged: 12/14/2020
Merged by: @dani-garcia

Base: master ← Head: fix-key-rotate

📝 Commits (1)

de86aa6 Fix Key Rotation during password change

📊 Changes

13 files changed (+83 additions, -18 deletions)

View changed files

➕ migrations/mysql/2020-12-09-173101_add_stamp_exception/down.sql (+0 -0)
➕ migrations/mysql/2020-12-09-173101_add_stamp_exception/up.sql (+1 -0)
➕ migrations/postgresql/2020-12-09-173101_add_stamp_exception/down.sql (+0 -0)
➕ migrations/postgresql/2020-12-09-173101_add_stamp_exception/up.sql (+1 -0)
➕ migrations/sqlite/2020-12-09-173101_add_stamp_exception/down.sql (+0 -0)
➕ migrations/sqlite/2020-12-09-173101_add_stamp_exception/up.sql (+1 -0)
📝 src/api/core/accounts.rs (+5 -4)
📝 src/auth.rs (+22 -10)
📝 src/db/models/mod.rs (+1 -1)
📝 src/db/models/user.rs (+49 -3)
📝 src/db/schemas/mysql/schema.rs (+1 -0)
📝 src/db/schemas/postgresql/schema.rs (+1 -0)
📝 src/db/schemas/sqlite/schema.rs (+1 -0)

📄 Description

When ticking the 'Also rotate my account's encryption key' box, the key
rotated ciphers are posted after the change of password.

During the password change the security stamp was reseted which made
the posted key's return an invalid auth. This reset is needed to prevent other clients from still being able to read/write.

This fixes this by adding a new database column which stores a stamp exception which includes the allowed route and the current security stamp before it gets reseted.
When the security stamp check fails it will check if there is a stamp exception and tries to match the route and security stamp.

Currently it only allows for one exception. But if needed we could expand it by using a Vec<UserStampException> and change the functions accordingly.

fixes #1240

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/1243 **Author:** [@BlackDex](https://github.com/BlackDex) **Created:** 11/28/2020 **Status:** ✅ Merged **Merged:** 12/14/2020 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `master` ← **Head:** `fix-key-rotate` --- ### 📝 Commits (1) - [`de86aa6`](https://github.com/dani-garcia/vaultwarden/commit/de86aa671eec9d08ab0e0d4cdd30584606882732) Fix Key Rotation during password change ### 📊 Changes **13 files changed** (+83 additions, -18 deletions) <details> <summary>View changed files</summary> ➕ `migrations/mysql/2020-12-09-173101_add_stamp_exception/down.sql` (+0 -0) ➕ `migrations/mysql/2020-12-09-173101_add_stamp_exception/up.sql` (+1 -0) ➕ `migrations/postgresql/2020-12-09-173101_add_stamp_exception/down.sql` (+0 -0) ➕ `migrations/postgresql/2020-12-09-173101_add_stamp_exception/up.sql` (+1 -0) ➕ `migrations/sqlite/2020-12-09-173101_add_stamp_exception/down.sql` (+0 -0) ➕ `migrations/sqlite/2020-12-09-173101_add_stamp_exception/up.sql` (+1 -0) 📝 `src/api/core/accounts.rs` (+5 -4) 📝 `src/auth.rs` (+22 -10) 📝 `src/db/models/mod.rs` (+1 -1) 📝 `src/db/models/user.rs` (+49 -3) 📝 `src/db/schemas/mysql/schema.rs` (+1 -0) 📝 `src/db/schemas/postgresql/schema.rs` (+1 -0) 📝 `src/db/schemas/sqlite/schema.rs` (+1 -0) </details> ### 📄 Description When ticking the 'Also rotate my account's encryption key' box, the key rotated ciphers are posted after the change of password. During the password change the security stamp was reseted which made the posted key's return an invalid auth. This reset is needed to prevent other clients from still being able to read/write. This fixes this by adding a new database column which stores a stamp exception which includes the allowed route and the current security stamp before it gets reseted. When the security stamp check fails it will check if there is a stamp exception and tries to match the route and security stamp. Currently it only allows for one exception. But if needed we could expand it by using a `Vec<UserStampException>` and change the functions accordingly. fixes #1240 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-03-07 21:01:03 -06:00

GiteaMirror closed this issue

2026-03-07 21:01:03 -06:00

GiteaMirror referenced this issue

2026-03-07 21:17:42 -06:00

[PR #6566] [MERGED] Revert to gzip compression #7444

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#6566