starred/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-02-05 00:29:40 +03:00
Code Issues 32 Packages Projects Releases 10 Wiki Activity

Android & iOS Push don't work using EU Data Region #1649

New Issue
Closed
opened 2026-02-05 01:24:48 +03:00 by OVERLORD · 6 comments
OVERLORD commented 2026-02-05 01:24:48 +03:00
Owner
Copy Link

Originally created by @doschn on GitHub (Jul 26, 2023).

Subject of the issue

Push notifications do not work, using a freshly re-installed apps - Version. 2023.7.0 (6781 on Android, 3881 on iPad )
I already checked for relevant issues and double-checked environmental variables - they are correctly implemented according to the guide and mentioned issue (see vaultwarden.conf content below - also shown correctly within the admin panel)

neither cloudflare WAF nor haproxy or surricata on OPNsense show any blocked requests or anomalies within the logfiles.

Deployment environment

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.29.0
  • Web-vault version: v2023.5.0
  • OS/Arch: linux/x86_64
  • Running within Docker: true (Base: Debian)
  • Environment settings overridden: false
  • Uses a reverse proxy: false (true, admin-panel blocked via external access)
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: true
  • Domain Configuration Check: false (true, admin-panel blocked via external access, using differing internal url)
  • HTTPS Check: true
  • Database type: SQLite
  • Database version: 3.41.2
  • Clients used: 1. MS-Edge + Chrome Browser Plugins (Live Update works) & 2. Android App, Version. 2023.7.0 (6781) & iOS App
  • Reverse proxy and version: Cloudflare WAF, redirecting to HAProxy (V 4.1, hosted on local OPNsense)
  • Other relevant information:
    may be an issue with push-services using Data Region "bitwarden.eu European Union" - are there any configuration / env parameters for changing the Push relay base uri?

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_smtp_img_src": "cid:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://******************",
  "domain_origin": "*****://******************",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": "***",
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Home",
  "invitations_allowed": true,
  "ip_header": "X-Forwarded-For",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 100000,
  "push_enabled": true,
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": true,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": true,
  "signups_allowed": false,
  "signups_domains_whitelist": "***************",
  "signups_verify": true,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": "\"Login\"",
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "******************",
  "smtp_from_name": "Bitwarden_RS",
  "smtp_host": "**************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "******************",
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": false,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

  • vaultwarden version: 1.29.0

  • Install method:
    Podman (3:4.4.1-14) + systemd Service hosted on AlmaLinux release 8.8

[Unit]
Description=Podman container-vaultwarden.service
Documentation=man:podman-generate-systemd(1)
Wants=network.target
After=network-online.target

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStartPre=/bin/rm -f %t/container-vaultwarden.pid %t/container-vaultwarden.ctr-id
ExecStart=/usr/bin/podman run --conmon-pidfile %t/container-vaultwarden.pid --cidfile %t/container-vaultwarden.ctr-id --env-file=/opt/vaultwarden/vaultwarden.conf --cgroups=no-conmon --replace -d --name vaultwarden --label io.containers.autoupdate=image -v /opt/bw-data/:/data/:Z -p 80:80 docker.io/vaultwarden/server:latest
ExecStop=/usr/bin/podman stop --ignore --cidfile %t/container-vaultwarden.ctr-id -t 10
ExecStopPost=/usr/bin/podman rm --ignore -f --cidfile %t/container-vaultwarden.ctr-id
PIDFile=%t/container-vaultwarden.pid
Type=forking

[Install]
WantedBy=multi-user.target default.target

Content of /opt/vaultwarden/vaultwarden.conf:

PUSH_ENABLED=true
PUSH_INSTALLATION_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx
PUSH_INSTALLATION_KEY=<20 character long string>
  • Other relevant details:
    user (MFA enabled) is member of an organization, groups disabled (organization currently empty, no collections created)
    tried re-installing the app, clearing all app-data (cache & data).

Steps to reproduce

  1. registering for a push id and key at bitwarden.com
  2. creating vaultwarden.conf, containing content above
  3. changing systemd service-file to include envs from .conf file
  4. systemctl daemon-reload
  5. restarting container-vaultwarden.service
  6. uninstalling app
  7. installing app
  8. logging in to vaultwarden

Expected behaviour

Push notifications working

Actual behaviour

push-notifications doesn't work, throwing following errors:

[2023-07-26 18:46:24.104][request][INFO] PUT /api/devices/identifier/<string differing from installation-id>/token
[2023-07-26 18:46:24.552][vaultwarden::api::push][ERROR] Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26
[2023-07-26 18:46:24.559][vaultwarden::api::core::accounts][ERROR] An error occured while proceeding registration of a device: {"ErrorModel":{"Message":"Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26","Object":"error"},"ExceptionMessage":null,"ExceptionStackTrace":null,"InnerExceptionMessage":null,"Message":"Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26","Object":"error","ValidationErrors":{"":["Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26"]},"error":"","error_description":""}
[2023-07-26 18:46:24.559][response][INFO] (put_device_token) PUT /api/devices/identifier/<uuid>/token => 400 Bad Request

Troubleshooting data

will be attached if required

Originally created by @doschn on GitHub (Jul 26, 2023). ### Subject of the issue <!-- Describe your issue here. --> Push notifications do not work, using a freshly re-installed apps - Version. 2023.7.0 (6781 on Android, 3881 on iPad ) I already checked for relevant [issues](https://github.com/dani-garcia/vaultwarden/discussions/3700) and double-checked environmental variables - they are correctly implemented according to the [guide](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Mobile-Client-push-notification) and mentioned issue (see vaultwarden.conf content below - also shown correctly within the admin panel) neither cloudflare WAF nor haproxy or surricata on OPNsense show any blocked requests or anomalies within the logfiles. ### Deployment environment ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.29.0 * Web-vault version: v2023.5.0 * OS/Arch: linux/x86_64 * Running within Docker: true (Base: Debian) * Environment settings overridden: false * Uses a reverse proxy: false (true, admin-panel blocked via external access) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: false (true, admin-panel blocked via external access, using differing internal url) * HTTPS Check: true * Database type: SQLite * Database version: 3.41.2 * Clients used: 1. MS-Edge + Chrome Browser Plugins (Live Update works) & 2. Android App, Version. 2023.7.0 (6781) & iOS App * Reverse proxy and version: Cloudflare WAF, redirecting to HAProxy (V 4.1, hosted on local OPNsense) * Other relevant information: may be an issue with push-services using Data Region "bitwarden.eu European Union" - are there any configuration / env parameters for changing the Push relay base uri? ### Config (Generated via diagnostics page) <details><summary>Show Running Config</summary> **Environment settings which are overridden:** ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": true, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_smtp_img_src": "cid:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_max_conns": 10, "database_timeout": 30, "database_url": "***************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://******************", "domain_origin": "*****://******************", "domain_path": "", "domain_set": true, "duo_host": null, "duo_ikey": null, "duo_skey": null, "email_attempts_limit": 3, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "extended_logging": true, "helo_name": null, "hibp_api_key": "***", "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "invitation_expiration_hours": 120, "invitation_org_name": "Home", "invitations_allowed": true, "ip_header": "X-Forwarded-For", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "Info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 100000, "push_enabled": true, "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": true, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": true, "signups_allowed": false, "signups_domains_whitelist": "***************", "signups_verify": true, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": "\"Login\"", "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "******************", "smtp_from_name": "Bitwarden_RS", "smtp_host": "**************", "smtp_password": "***", "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": "******************", "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "websocket_address": "0.0.0.0", "websocket_enabled": false, "websocket_port": 3012, "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> <!-- ========================================================================================= Preferably, use the `Generate Support String` button on the admin page's Diagnostics tab. That will auto-generate most of the info requested in this section. ========================================================================================= --> <!-- The version number, obtained from the logs (at startup) or the admin diagnostics page --> <!-- This is NOT the version number shown on the web vault, which is versioned separately from vaultwarden --> <!-- Remember to check if your issue exists on the latest version first! --> * vaultwarden version: 1.29.0 * Install method: Podman (3:4.4.1-14) + systemd Service hosted on AlmaLinux release 8.8 ``` [Unit] Description=Podman container-vaultwarden.service Documentation=man:podman-generate-systemd(1) Wants=network.target After=network-online.target [Service] Environment=PODMAN_SYSTEMD_UNIT=%n Restart=on-failure TimeoutStopSec=70 ExecStartPre=/bin/rm -f %t/container-vaultwarden.pid %t/container-vaultwarden.ctr-id ExecStart=/usr/bin/podman run --conmon-pidfile %t/container-vaultwarden.pid --cidfile %t/container-vaultwarden.ctr-id --env-file=/opt/vaultwarden/vaultwarden.conf --cgroups=no-conmon --replace -d --name vaultwarden --label io.containers.autoupdate=image -v /opt/bw-data/:/data/:Z -p 80:80 docker.io/vaultwarden/server:latest ExecStop=/usr/bin/podman stop --ignore --cidfile %t/container-vaultwarden.ctr-id -t 10 ExecStopPost=/usr/bin/podman rm --ignore -f --cidfile %t/container-vaultwarden.ctr-id PIDFile=%t/container-vaultwarden.pid Type=forking [Install] WantedBy=multi-user.target default.target ``` Content of /opt/vaultwarden/vaultwarden.conf: ``` PUSH_ENABLED=true PUSH_INSTALLATION_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx PUSH_INSTALLATION_KEY=<20 character long string> ``` * Other relevant details: user (MFA enabled) is member of an organization, groups disabled (organization currently empty, no collections created) tried re-installing the app, clearing all app-data (cache & data). ### Steps to reproduce 1. registering for a push id and key at [bitwarden.com](https://bitwarden.com/host/) 2. creating vaultwarden.conf, containing content above 3. changing systemd service-file to include envs from .conf file 4. systemctl daemon-reload 5. restarting container-vaultwarden.service 6. uninstalling app 7. installing app 8. logging in to vaultwarden ### Expected behaviour Push notifications working ### Actual behaviour push-notifications doesn't work, throwing following errors: ``` [2023-07-26 18:46:24.104][request][INFO] PUT /api/devices/identifier/<string differing from installation-id>/token [2023-07-26 18:46:24.552][vaultwarden::api::push][ERROR] Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26 [2023-07-26 18:46:24.559][vaultwarden::api::core::accounts][ERROR] An error occured while proceeding registration of a device: {"ErrorModel":{"Message":"Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26","Object":"error"},"ExceptionMessage":null,"ExceptionStackTrace":null,"InnerExceptionMessage":null,"Message":"Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26","Object":"error","ValidationErrors":{"":["Unexpected push token received from bitwarden server: error decoding response body: missing field `access_token` at line 1 column 26"]},"error":"","error_description":""} [2023-07-26 18:46:24.559][response][INFO] (put_device_token) PUT /api/devices/identifier/<uuid>/token => 400 Bad Request ``` ### Troubleshooting data will be attached if required
OVERLORD commented 2026-02-05 01:24:50 +03:00
Author
Owner
Copy Link

@BlackDex commented on GitHub (Jul 26, 2023):

Verify that the ID and Key are valid by checking if they match within the admin settings interface.
No spaces or anything should be surrounded.

Also see #3699

@BlackDex commented on GitHub (Jul 26, 2023): Verify that the ID and Key are valid by checking if they match within the admin settings interface. No spaces or anything should be surrounded. Also see #3699
OVERLORD commented 2026-02-05 01:24:53 +03:00
Author
Owner
Copy Link

@doschn commented on GitHub (Jul 26, 2023):

they are fine without any additional characters, double-checked it multiple times.
I assume it could be an issue with the hard-coded Push relay base uri pointing at https://push.bitwarden.com when using the Euopean Data Region. > https://bitwarden.com/host/

Update: changing PUSH_RELAY_BASE_URI=https://push.bitwarden.eu within the vaultwarden.conf according to the official server geographies documentation (https://bitwarden.com/help/server-geographies/) do not have any impact on the setting within admin-panel. it still remains on https://push.bitwarden.com
remark: ENV is passed to the container

@doschn commented on GitHub (Jul 26, 2023): they are fine without any additional characters, double-checked it multiple times. I assume it could be an issue with the hard-coded _Push relay base uri_ pointing at **https://push.bitwarden.com** when using the Euopean Data Region. > https://bitwarden.com/host/ Update: changing PUSH_RELAY_BASE_URI=https://push.bitwarden.eu within the vaultwarden.conf according to the official server geographies documentation (https://bitwarden.com/help/server-geographies/) do not have any impact on the setting within admin-panel. it still remains on https://push.bitwarden.com remark: ENV is passed to the container
OVERLORD commented 2026-02-05 01:24:56 +03:00
Author
Owner
Copy Link

@BlackDex commented on GitHub (Jul 26, 2023):

It should be https://push.bitwarden.com and nothing else.
Please try to enable debug logging and see if there is anything wrong with accessing the internet or resolving the push domain.
Maybe it shows something else that goes wrong.

It seems to work just fine for me.

@BlackDex commented on GitHub (Jul 26, 2023): It should be `https://push.bitwarden.com` and nothing else. Please try to enable debug logging and see if there is anything wrong with accessing the internet or resolving the push domain. Maybe it shows something else that goes wrong. It seems to work just fine for me.
OVERLORD commented 2026-02-05 01:25:00 +03:00
Author
Owner
Copy Link

@BlackDex commented on GitHub (Jul 27, 2023):

It should be https://push.bitwarden.com and nothing else. Please try to enable debug logging and see if there is anything wrong with accessing the internet or resolving the push domain. Maybe it shows something else that goes wrong.
It seems to work just fine for me.

Give us your conf for examples then sir.

Nothing much to give as the settings are just done via ENV variables using docker.
And it's not a good idea to post my key and id here ;)

@BlackDex commented on GitHub (Jul 27, 2023): > > It should be `https://push.bitwarden.com` and nothing else. Please try to enable debug logging and see if there is anything wrong with accessing the internet or resolving the push domain. Maybe it shows something else that goes wrong. > > It seems to work just fine for me. > > Give us your conf for examples then sir. Nothing much to give as the settings are just done via ENV variables using docker. And it's not a good idea to post my key and id here ;)
OVERLORD commented 2026-02-05 01:25:02 +03:00
Author
Owner
Copy Link

@BlackDex commented on GitHub (Jul 27, 2023):

@doschn any update? Do you have any logs with debug enabled?
I'm not able to reproduce this with a valid key and id only with invalid values.

@BlackDex commented on GitHub (Jul 27, 2023): @doschn any update? Do you have any logs with debug enabled? I'm not able to reproduce this with a valid key and id only with invalid values.
OVERLORD commented 2026-02-05 01:25:05 +03:00
Author
Owner
Copy Link

@doschn commented on GitHub (Jul 27, 2023):

@BlackDex I've been busy at work.
Recently I was able to fix it by requesting an additional Instance ID and Instance Key for the US Data Region and changing the ENV to the new ones.

I'll add a notice to the Wiki Page that EU Data Region is currently not supported for push notifications.

Can we modify this bug report into a feature-request to add support for push notifications using the EU servers or should i open a new one?

@doschn commented on GitHub (Jul 27, 2023): @BlackDex I've been busy at work. Recently I was able to fix it by requesting an additional Instance ID and Instance Key for the US Data Region and changing the ENV to the new ones. I'll add a notice to the Wiki Page that EU Data Region is currently not supported for push notifications. Can we modify this bug report into a feature-request to add support for push notifications using the EU servers or should i open a new one?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
troubleshooting
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#1649
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?