starred/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2025-12-10 01:10:09 +03:00
Code Issues 429 Packages Projects Releases 10 Wiki Activity

Changing KDF iterations breaks logged in clients #1600

New Issue
Closed
opened 2025-10-09 17:21:57 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2025-10-09 17:21:57 +03:00
Owner
Copy Link

Originally created by @julian-klode on GitHub.

Subject of the issue

Changing number KDF iterations breaks logged in clients. They should be logged out instead.

Your environment

  • Bitwarden_rs version: 1.16.3
  • Install method: Built from source
  • Clients used: latest Android from play store and Desktop from snap store
  • Reverse proxy and version: Nginx from focal

Steps to reproduce

Change KDF size, then sync client or wait for corruption to appear automatically.

Expected behaviour

Seeing what bitwarden.com does: Connected clients are logged out.

Actual behaviour

Connected clients fail to read the database

Relevant logs

Not much interesting going on. I triggered a sync on mobile manually, as it apparently did not get a push.

Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.093][request][INFO] POST /api/accounts/kdf
Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.181][response][INFO] POST /api/accounts/kdf (post_kdf) => 200 OK
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][request][INFO] GET /api/accounts/revision-date
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][response][INFO] GET /api/accounts/revision-date (revision_date) => 200 OK
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.445][request][INFO] GET /api/sync
Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.459][response][INFO] GET /api/sync?<data..> (sync) => 200 OK
Originally created by @julian-klode on GitHub. ### Subject of the issue Changing number KDF iterations breaks logged in clients. They should be logged out instead. ### Your environment * Bitwarden_rs version: 1.16.3 * Install method: Built from source * Clients used: latest Android from play store and Desktop from snap store * Reverse proxy and version: Nginx from focal ### Steps to reproduce Change KDF size, then sync client or wait for corruption to appear automatically. ### Expected behaviour Seeing what bitwarden.com does: Connected clients are logged out. ### Actual behaviour Connected clients fail to read the database ### Relevant logs Not much interesting going on. I triggered a sync on mobile manually, as it apparently did not get a push. ``` Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.093][request][INFO] POST /api/accounts/kdf Sep 29 23:50:58 magenta bitwarden_rs[902666]: [2020-09-29 23:50:58.181][response][INFO] POST /api/accounts/kdf (post_kdf) => 200 OK Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][request][INFO] GET /api/accounts/revision-date Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.393][response][INFO] GET /api/accounts/revision-date (revision_date) => 200 OK Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.445][request][INFO] GET /api/sync Sep 29 23:51:07 magenta bitwarden_rs[902666]: [2020-09-29 23:51:07.459][response][INFO] GET /api/sync?<data..> (sync) => 200 OK ```
OVERLORD commented 2025-10-09 17:22:00 +03:00
Author
Owner
Copy Link

@BlackDex commented on GitHub:

Hmm, we have to deauthorize all the user sessions in this case it seems. Thanks for reporting.

Please note that we do not support push messages so that is not possible on our side.

@BlackDex commented on GitHub: Hmm, we have to deauthorize all the user sessions in this case it seems. Thanks for reporting. Please note that we do not support push messages so that is not possible on our side.
OVERLORD commented 2025-10-09 17:22:01 +03:00
Author
Owner
Copy Link

@dani-garcia commented on GitHub:

This should be fixed by 448e6ac917, which invalidates users sessions when they change email, pass or kdf params.

@dani-garcia commented on GitHub: This should be fixed by https://github.com/dani-garcia/bitwarden_rs/commit/448e6ac917e6bf34f7a5af175714eef9058b6021, which invalidates users sessions when they change email, pass or kdf params.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
bug
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
troubleshooting
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#1600
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?