[PR #6205] Improve sso auth flow #2441

New Issue

OVERLORD · 2025-10-09T18:05:13+03:00

OVERLORD commented

2025-10-09 18:05:13 +03:00

Original Pull Request: https://github.com/dani-garcia/vaultwarden/pull/6205

State: open
Merged: No

This PR make multiple modifications to the authentication flow:

stop wrapping the returned values from the authorization (code or error) in a JWT token to pass through Bitwarden redirection. Instead, it stores them in database and use the state to find them again.
The length of the JWT Token might have been causing issue with the desktop client and Chrome on Windows.
stop using a memory cache to store the User information in case a 2FA flow is triggered, use the database that we were reading anyway.
Validate the Bitwarden clients PKCE code challenge to ensure that the client exchanging the code is the one which initiated the request (Either pass it to the provider or check it before calling it).

Documentation which could be added to the wiki:

On `SSO_PKCE`

When activated the Bitwarden Clients PKCE code challenge are passed to the provider.
If disabled PKCE validation is still done before exchanging the code.

**Original Pull Request:** https://github.com/dani-garcia/vaultwarden/pull/6205 **State:** open **Merged:** No --- This PR make multiple modifications to the authentication flow: - stop wrapping the returned values from the authorization (`code` or `error`) in a JWT token to pass through Bitwarden redirection. Instead, it stores them in database and use the `state` to find them again. The length of the JWT Token might have been causing issue with the desktop client and Chrome on Windows. - stop using a memory cache to store the User information in case a 2FA flow is triggered, use the database that we were reading anyway. - Validate the Bitwarden clients PKCE code challenge to ensure that the client exchanging the `code` is the one which initiated the request (Either pass it to the provider or check it before calling it). ------- Documentation which could be added to the wiki: ## Login Flow ### On `SSO_PKCE` When activated the Bitwarden Clients PKCE code challenge are passed to the provider. If disabled PKCE validation is still done before exchanging the code.

OVERLORD added the pull-request label 2025-10-09 18:05:13 +03:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#2441

[PR #6205] Improve sso auth flow #2441

Login Flow

On SSO_PKCE

On `SSO_PKCE`