U2F not working on Chrome 75 #2122

New Issue

Closed

opened 2025-10-09 17:46:27 +03:00 by OVERLORD · 10 comments

OVERLORD commented 2025-10-09 17:46:27 +03:00

Owner

Copy Link

Originally created by @n1am on GitHub.

Hi,
I'm running bitwarden_rs on docker behind an nginx proxy, using the same nginx configuration posted in the wiki.

I'm having trouble registering my U2F keys on Chrome (version 74 and 75-dev). During che registration process I get this error:
listening for key... Fetch finished loading: POST "https://mydomain.ltd/api/two-factor/get-u2f-challenge". u2f.js:628 Extension JS API Version: 1.1 two-factor-u2f.component.ts:138 error: 2

Using Firefox (with u2f support enabled) the registration and login process works fine. I used Firefox 66.0.4 and Firefox ESR 60.6.2.

Best regards
Andrea

Originally created by @n1am on GitHub. Hi, I'm running bitwarden_rs on docker behind an nginx proxy, using the same nginx configuration posted in the wiki. I'm having trouble registering my U2F keys on Chrome (version 74 and 75-dev). During che registration process I get this error: `listening for key... Fetch finished loading: POST "https://mydomain.ltd/api/two-factor/get-u2f-challenge". u2f.js:628 Extension JS API Version: 1.1 two-factor-u2f.component.ts:138 error: 2` Using Firefox (with u2f support enabled) the registration and login process works fine. I used Firefox 66.0.4 and Firefox ESR 60.6.2. Best regards Andrea

OVERLORD closed this issue 2025-10-09 17:46:29 +03:00

OVERLORD commented 2025-10-09 17:46:31 +03:00

Author

Owner

Copy Link

@kuruptedfiend commented on GitHub:

I am also seeing this issue with Chrome 74. Keys work fine in Firefox, previously worked in Chrome.

@kuruptedfiend commented on GitHub: I am also seeing this issue with Chrome 74. Keys work fine in Firefox, previously worked in Chrome.

OVERLORD commented 2025-10-09 17:46:31 +03:00

Author

Owner

Copy Link

@algernon commented on GitHub:

I'm seeing the same issue with Chrome 74 on Linux. My keys work fine under Firefox, but for some odd reason, it fails in Chrome.

FWIW, the Yubikey in question used to work at other places in Chrome, but even those fail now, while Firefox works. I guess this is a Chrome issue...

@algernon commented on GitHub: I'm seeing the same issue with Chrome 74 on Linux. My keys work fine under Firefox, but for some odd reason, it fails in Chrome. FWIW, the Yubikey in question used to work at other places in Chrome, but even those fail now, while Firefox works. I guess this is a Chrome issue...

OVERLORD commented 2025-10-09 17:46:32 +03:00

Author

Owner

Copy Link

@dani-garcia commented on GitHub:

Did you configure the DOMAIN env variable to be equal to the URL used to access the service? Like https://mydomain.ltd.

Error 2 is usually a mismatched URL.

@dani-garcia commented on GitHub: Did you configure the DOMAIN env variable to be equal to the URL used to access the service? Like `https://mydomain.ltd`. Error 2 is usually a mismatched URL.

OVERLORD commented 2025-10-09 17:46:32 +03:00

Author

Owner

Copy Link

@n1am commented on GitHub:

Hi,
thanks for the quick reply.
The DOMAIN env variable is equal to the URL and the app-id.json presents the right URL.

I've encountered the problem only on Chrome. Using Firefox the auth process using U2F does not result in any error. I tried on different PC, with the latest Chrome stable and Dev version, unfortunately the issue persist. So I'm thinking that the problem is Chrome since it works fine on Firefox.

When I'm asked to insert the U2F security key, in the Chrome console I'm getting this error 400 in this request url: https://vault.mydomain.ltd/identity/connect/token

@n1am commented on GitHub: Hi, thanks for the quick reply. The DOMAIN env variable is equal to the URL and the app-id.json presents the right URL. I've encountered the problem only on Chrome. Using Firefox the auth process using U2F does not result in any error. I tried on different PC, with the latest Chrome stable and Dev version, unfortunately the issue persist. So I'm thinking that the problem is Chrome since it works fine on Firefox. When I'm asked to insert the U2F security key, in the Chrome console I'm getting this error 400 in this request url: https://vault.mydomain.ltd/identity/connect/token

OVERLORD commented 2025-10-09 17:46:33 +03:00

Author

Owner

Copy Link

@allgoewer commented on GitHub:

I am having the same problem with chrome 74 (Windows 10).
Console output is the same as @n1am is getting.

Edit: The u2f-key is a Yubikey 4. Contrary to @algernon's observation, the key works with other sites, such as gmail or github.

My app-id.json looks like this:

$ curl https://bw.llgoewer.de/app-id.json | jq '.'
{
  "trustedFacets": [
    {
      "ids": [
        "https://bw.llgoewer.de",
        "ios:bundle-id:com.8bit.bitwarden",
        "android:apk-key-hash:dUGFzUzf3lmHSLBDBIv+WaFyZMI"
      ],
      "version": {
        "major": 1,
        "minor": 0
      }
    }
  ]
}

@allgoewer commented on GitHub: I am having the same problem with chrome 74 (Windows 10). Console output is the same as @n1am is getting. **Edit**: The u2f-key is a Yubikey 4. Contrary to @algernon's observation, the key works with other sites, such as gmail or github. My app-id.json looks like this: ``` $ curl https://bw.llgoewer.de/app-id.json | jq '.' { "trustedFacets": [ { "ids": [ "https://bw.llgoewer.de", "ios:bundle-id:com.8bit.bitwarden", "android:apk-key-hash:dUGFzUzf3lmHSLBDBIv+WaFyZMI" ], "version": { "major": 1, "minor": 0 } } ] } ```

OVERLORD commented 2025-10-09 17:46:34 +03:00

Author

Owner

Copy Link

@dani-garcia commented on GitHub:

So I tried registering a key just now and the errorCode 2 seems to be caused by an encoding issue:

Chrome expects base64url while we send normal base64, I think.

Also not sure if related, as I couldn't look into it, but gitea is also having problems with U2F and Chrome 74, which makes me think there was a recent change in Chrome breaking this:
https://github.com/go-gitea/gitea/issues/6748

@dani-garcia commented on GitHub: So I tried registering a key just now and the errorCode 2 seems to be caused by an encoding issue:  Chrome expects base64url while we send normal base64, I think. Also not sure if related, as I couldn't look into it, but gitea is also having problems with U2F and Chrome 74, which makes me think there was a recent change in Chrome breaking this: https://github.com/go-gitea/gitea/issues/6748

OVERLORD commented 2025-10-09 17:46:34 +03:00

Author

Owner

Copy Link

@dani-garcia commented on GitHub:

I've updated the u2f crate to use base64url with no padding in all cases, and switched it in a commit right now, and that seems to solve the issue for me.

For anyone wanting to test it, you can compile the master branch of the project yourselves or wait a couple of hours until the docker images are built.

After some more users confirm the fix works I'll send a PR to the official u2f repo, instead of using the fork.

@dani-garcia commented on GitHub: I've updated the u2f crate to use base64url with no padding in all cases, and switched it in a commit right now, and that seems to solve the issue for me. For anyone wanting to test it, you can compile the master branch of the project yourselves or wait a couple of hours until the docker images are built. After some more users confirm the fix works I'll send a PR to the official u2f repo, instead of using the fork.

OVERLORD commented 2025-10-09 17:46:35 +03:00

Author

Owner

Copy Link

@allgoewer commented on GitHub:

It seems to also be working for me, Chrome and Firefox.

@allgoewer commented on GitHub: It seems to also be working for me, Chrome and Firefox.

OVERLORD commented 2025-10-09 17:46:35 +03:00

Author

Owner

Copy Link

@allgoewer commented on GitHub:

This is the corresponding chromium-commit which forces challenges to be base64-url encoded (according to spec).

u2f-rs encodes the challenge as base64, see this line

@allgoewer commented on GitHub: This is the corresponding [chromium-commit](https://github.com/chromium/chromium/commit/ceb92979d1f3a77146ed68f8484636ce63073625) which forces challenges to be base64-url encoded (according to spec). u2f-rs encodes the challenge as base64, [see this line](https://github.com/wisespace-io/u2f-rs/blob/50626547653da4a2e3fe7b4b4e7703d4fc5267ec/src/protocol.rs#L49)

OVERLORD commented 2025-10-09 17:46:35 +03:00

Author

Owner

Copy Link

@n1am commented on GitHub:

Hi,
just tested the latest build. Problem solved.

Thanks

@n1am commented on GitHub: Hi, just tested the latest build. Problem solved. Thanks

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

test_dylint

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

bug

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

troubleshooting

wontfix

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

OVERLORD

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#2122