github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-08-27 05:35:03 -05:00
Code Issues 534 Packages Projects Releases 86 Wiki Activity

Changing KDF iterations breaks logged in clients #816

New Issue
Closed
opened 2025-11-07 06:49:25 -06:00 by GiteaMirror · 2 comments
GiteaMirror commented 2025-11-07 06:49:25 -06:00
Owner
Copy Link
Copy Source

Originally created by @julian-klode on GitHub (Sep 29, 2020).

Subject of the issue

Changing number KDF iterations breaks logged in clients. They should be logged out instead.

Your environment

  • Bitwarden_rs version: 1.16.3
  • Install method: Built from source
  • Clients used: latest Android from play store and Desktop from snap store
  • Reverse proxy and version: Nginx from focal

Steps to reproduce

Change KDF size, then sync client or wait for corruption to appear automatically.

Expected behaviour

Seeing what bitwarden.com does: Connected clients are logged out.

Actual behaviour

Connected clients fail to read the database

Relevant logs

Not much interesting going on. I triggered a sync on mobile manually, as it apparently did not get a push.

Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.093][request][INFO] POST /api/accounts/kdf
Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.181][response][INFO] POST /api/accounts/kdf (post_kdf) => 200 OK
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][request][INFO] GET /api/accounts/revision-date
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][response][INFO] GET /api/accounts/revision-date (revision_date) => 200 OK
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.445][request][INFO] GET /api/sync
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.459][response][INFO] GET /api/sync?<data..> (sync) => 200 OK
Originally created by @julian-klode on GitHub (Sep 29, 2020). ### Subject of the issue Changing number KDF iterations breaks logged in clients. They should be logged out instead. ### Your environment * Bitwarden_rs version: 1.16.3 * Install method: Built from source * Clients used: latest Android from play store and Desktop from snap store * Reverse proxy and version: Nginx from focal ### Steps to reproduce Change KDF size, then sync client or wait for corruption to appear automatically. ### Expected behaviour Seeing what bitwarden.com does: Connected clients are logged out. ### Actual behaviour Connected clients fail to read the database ### Relevant logs Not much interesting going on. I triggered a sync on mobile manually, as it apparently did not get a push. ``` Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.093][request][INFO] POST /api/accounts/kdf Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.181][response][INFO] POST /api/accounts/kdf (post_kdf) => 200 OK Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][request][INFO] GET /api/accounts/revision-date Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][response][INFO] GET /api/accounts/revision-date (revision_date) => 200 OK Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.445][request][INFO] GET /api/sync Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.459][response][INFO] GET /api/sync?<data..> (sync) => 200 OK ```
GiteaMirror commented 2025-11-07 06:49:25 -06:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Sep 29, 2020):

Hmm, we have to deauthorize all the user sessions in this case it seems. Thanks for reporting.

Please note that we do not support push messages so that is not possible on our side.

@BlackDex commented on GitHub (Sep 29, 2020): Hmm, we have to deauthorize all the user sessions in this case it seems. Thanks for reporting. Please note that we do not support push messages so that is not possible on our side.
GiteaMirror commented 2025-11-07 06:49:26 -06:00
Author
Owner
Copy Link
Copy Source

@dani-garcia commented on GitHub (Oct 3, 2020):

This should be fixed by https://github.com/dani-garcia/bitwarden_rs/commit/448e6ac917e6bf34f7a5af175714eef9058b6021, which invalidates users sessions when they change email, pass or kdf params.

@dani-garcia commented on GitHub (Oct 3, 2020): This should be fixed by https://github.com/dani-garcia/bitwarden_rs/commit/448e6ac917e6bf34f7a5af175714eef9058b6021, which invalidates users sessions when they change email, pass or kdf params.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#816