TOTP Blocked when use proxy_intercept_errors for code 400 #1359

New Issue

OVERLORD · 2026-02-05T00:42:19+03:00

OVERLORD commented

2026-02-05 00:42:19 +03:00

Originally created by @webysther on GitHub (Sep 18, 2022).

Subject of the issue

When creating nice error pages I discovered that after login the page that request the TOTP is intercepted by reverse proxy when the page for code HTTP 400 is used

Deployment environment

Where is admin page Generate Support String!?

vaultwarden version: 1.25.2

Install method: docker
Clients used: web vault
Reverse proxy and version: Nginx Proxy Manager
MySQL/MariaDB or PostgreSQL version: SQLite
Other relevant details: Removed error_page 400 /.../400.html solve the problem

Steps to reproduce

Create a error page for HTTP 400 and try login with user configured TOTP:

error_page 400 /error_pages/HTTP400.html
proxy_intercept_errors on;

Expected behaviour

Workes with error pages 400 configured

Actual behaviour

Troubleshooting data

gzip on;
gzip_vary on;
gzip_min_length 20;
gzip_comp_level 9;
gzip_proxied any;
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/json;
gzip_disable "MSIE [1-6]\."; 

location /authelia {
    internal;
    set $upstream_authelia http://AUTHELIA/api/verify;
    proxy_pass_request_body off;
    proxy_pass $upstream_authelia;    
    proxy_set_header Content-Length "";
 
    # Timeout if the real server is dead
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
    client_body_buffer_size 128k;
    proxy_set_header Host $host;
    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr; 
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Uri $request_uri;
    proxy_set_header X-Forwarded-Ssl on;
    proxy_redirect  http://  $scheme://;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_cache_bypass $cookie_session;
    proxy_no_cache $cookie_session;
    proxy_buffers 4 32k;
 
    send_timeout 5m;
    proxy_read_timeout 240;
    proxy_send_timeout 240;
    proxy_connect_timeout 240;
}

location / {
    set $upstream_app http://VAULTWARDEN;
    proxy_pass $upstream_app;

    auth_request /authelia;
    auth_request_set $target_url $scheme://$http_host$request_uri;
    auth_request_set $user $upstream_http_remote_user;
    auth_request_set $groups $upstream_http_remote_groups;
    proxy_set_header Remote-User $user;
    proxy_set_header Remote-Groups $groups;

    client_max_body_size    10m;
    client_body_buffer_size 128k;

    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

    error_page 401 =302 https://auth.webysther.org/?rd=$target_url;

    send_timeout 5m;
    proxy_read_timeout 360;
    proxy_send_timeout 360;
    proxy_connect_timeout 360;
    proxy_buffering         off;
    proxy_request_buffering off;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_max_temp_file_size 0;

    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Uri $request_uri;
    proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_upgrade;
    proxy_redirect   http://  $scheme://;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_cache_bypass $cookie_session;
    proxy_no_cache $cookie_session;
    proxy_buffers 64 256k;

    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.0.0.0/8;
    set_real_ip_from 192.168.0.0/16;
    set_real_ip_from fc00::/7;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;
    proxy_set_header Connection "";


       error_page 400 /error_pages/HTTP400.html;
        error_page 402 /error_pages/HTTP402.html;
        error_page 403 /error_pages/HTTP403.html;
        error_page 404 /error_pages/HTTP404.html;
        error_page 500 /error_pages/HTTP500.html;
        error_page 501 /error_pages/HTTP501.html;
        error_page 502 /error_pages/HTTP502.html;
        error_page 503 /error_pages/HTTP503.html;
        proxy_intercept_errors on;

}

        location /error_pages/ {
                alias /data/nginx/error_pages/;
                internal;
        }

Originally created by @webysther on GitHub (Sep 18, 2022).   ### Subject of the issue  When creating nice error pages I discovered that after login the page that request the TOTP is intercepted by reverse proxy when the page for code HTTP 400 is used ### Deployment environment Where is admin page Generate Support String!?     * vaultwarden version: 1.25.2  * Install method: docker * Clients used: web vault  * Reverse proxy and version: Nginx Proxy Manager  * MySQL/MariaDB or PostgreSQL version: SQLite  * Other relevant details: Removed `error_page 400 /.../400.html` solve the problem ### Steps to reproduce  Create a error page for HTTP 400 and try login with user configured TOTP: ``` error_page 400 /error_pages/HTTP400.html proxy_intercept_errors on; ``` ### Expected behaviour  Workes with error pages 400 configured ### Actual behaviour  ![image](https://user-images.githubusercontent.com/750007/190882305-7bcf6d1f-232d-41b8-a013-fd1890cad325.png) ### Troubleshooting data  ``` gzip on; gzip_vary on; gzip_min_length 20; gzip_comp_level 9; gzip_proxied any; gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/json; gzip_disable "MSIE [1-6]\."; location /authelia { internal; set $upstream_authelia http://AUTHELIA/api/verify; proxy_pass_request_body off; proxy_pass $upstream_authelia; proxy_set_header Content-Length ""; # Timeout if the real server is dead proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; client_body_buffer_size 128k; proxy_set_header Host $host; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Uri $request_uri; proxy_set_header X-Forwarded-Ssl on; proxy_redirect http:// $scheme://; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_cache_bypass $cookie_session; proxy_no_cache $cookie_session; proxy_buffers 4 32k; send_timeout 5m; proxy_read_timeout 240; proxy_send_timeout 240; proxy_connect_timeout 240; } location / { set $upstream_app http://VAULTWARDEN; proxy_pass $upstream_app; auth_request /authelia; auth_request_set $target_url $scheme://$http_host$request_uri; auth_request_set $user $upstream_http_remote_user; auth_request_set $groups $upstream_http_remote_groups; proxy_set_header Remote-User $user; proxy_set_header Remote-Groups $groups; client_max_body_size 10m; client_body_buffer_size 128k; proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; error_page 401 =302 https://auth.webysther.org/?rd=$target_url; send_timeout 5m; proxy_read_timeout 360; proxy_send_timeout 360; proxy_connect_timeout 360; proxy_buffering off; proxy_request_buffering off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_max_temp_file_size 0; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Uri $request_uri; proxy_set_header X-Forwarded-Ssl on; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_upgrade; proxy_redirect http:// $scheme://; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_cache_bypass $cookie_session; proxy_no_cache $cookie_session; proxy_buffers 64 256k; set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.0.0.0/8; set_real_ip_from 192.168.0.0/16; set_real_ip_from fc00::/7; real_ip_header X-Forwarded-For; real_ip_recursive on; proxy_set_header Connection ""; error_page 400 /error_pages/HTTP400.html; error_page 402 /error_pages/HTTP402.html; error_page 403 /error_pages/HTTP403.html; error_page 404 /error_pages/HTTP404.html; error_page 500 /error_pages/HTTP500.html; error_page 501 /error_pages/HTTP501.html; error_page 502 /error_pages/HTTP502.html; error_page 503 /error_pages/HTTP503.html; proxy_intercept_errors on; } location /error_pages/ { alias /data/nginx/error_pages/; internal; } ```

OVERLORD closed this issue

2026-02-05 00:42:21 +03:00

OVERLORD commented

2026-02-05 00:42:25 +03:00

@webysther commented on GitHub (Sep 18, 2022):

To fix this problem maybe need to fix the HTTP request for the page of TOTP, which looks malformed.
For me don't make sense to use HTTP 400 for this, a 302 makes sense because the user and pass are correct, don't give the TOTP as the second step of the login flow.

@webysther commented on GitHub (Sep 18, 2022): To fix this problem maybe need to fix the HTTP request for the page of TOTP, which looks malformed. For me don't make sense to use HTTP 400 for this, a 302 makes sense because the user and pass are correct, don't give the TOTP as the second step of the login flow. ![image](https://user-images.githubusercontent.com/750007/190882508-0d15048d-3e27-41e8-97bd-ea7491996bc8.png)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#1359