Panic if temporary SMTP-Problem #504

Closed
opened 2025-10-09 16:35:01 +03:00 by OVERLORD · 2 comments
Owner

Originally created by @Subito on GitHub.

Subject of the issue

Sometimes on trying to send a 2FA-Mail, the SMTP Server replies with 454: 4.7.0 Temporary authentication failure, which should indicate to the sender "please try later, this is a temporary problem". However vaultwarden panics if it receives this error and the server stops.

Deployment environment

  • vaultwarden version: 1.30.3
  • Install method: FreeBSD pkg

  • Clients used: happens on all clients on Login

  • Reverse proxy and version: nginx

  • Other relevant details:

Expected behaviour

Server does not crash if it receives a temporary SMTP-Failure.

Actual behaviour

Server crashes and needs restarting.

Troubleshooting data

Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.251][vaultwarden::mail][ERROR] SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server
Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.252][panic][ERROR] thread 'tokio-runtime-worker' panicked at 'Error sending incomplete 2FA email: SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server': src/api/core/two_factor/mod.rs:273
Originally created by @Subito on GitHub. <!-- # ### NOTE: Please update to the latest version of vaultwarden before reporting an issue! This saves you and us a lot of time and troubleshooting. See: * https://github.com/dani-garcia/vaultwarden/issues/1180 * https://github.com/dani-garcia/vaultwarden/wiki/Updating-the-vaultwarden-image # ### --> <!-- Please fill out the following template to make solving your problem easier and faster for us. This is only a guideline. If you think that parts are unnecessary for your issue, feel free to remove them. Remember to hide/redact personal or confidential information, such as passwords, IP addresses, and DNS names as appropriate. --> ### Subject of the issue <!-- Describe your issue here. --> Sometimes on trying to send a 2FA-Mail, the SMTP Server replies with `454: 4.7.0 Temporary authentication failure`, which should indicate to the sender "please try later, this is a temporary problem". However vaultwarden panics if it receives this error and the server stops. ### Deployment environment <!-- ========================================================================================= Preferably, use the `Generate Support String` button on the admin page's Diagnostics tab. That will auto-generate most of the info requested in this section. ========================================================================================= --> <!-- The version number, obtained from the logs (at startup) or the admin diagnostics page --> <!-- This is NOT the version number shown on the web vault, which is versioned separately from vaultwarden --> <!-- Remember to check if your issue exists on the latest version first! --> * vaultwarden version: 1.30.3 <!-- How the server was installed: Docker image, OS package, built from source, etc. --> * Install method: FreeBSD pkg * Clients used: happens on all clients on Login <!-- web vault, desktop, Android, iOS, etc. (if applicable) --> * Reverse proxy and version: nginx <!-- if applicable --> * Other relevant details: ### Expected behaviour <!-- Tell us what you expected to happen --> Server does not crash if it receives a temporary SMTP-Failure. ### Actual behaviour <!-- Tell us what actually happened --> Server crashes and needs restarting. ### Troubleshooting data ``` Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.251][vaultwarden::mail][ERROR] SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server Apr 29 16:13:58 vault1 vaultwarden[66287]: [2024-04-29 16:13:58.252][panic][ERROR] thread 'tokio-runtime-worker' panicked at 'Error sending incomplete 2FA email: SMTP 4xx error: transient error (454): 4.7.0 Temporary authentication failure: Connection lost to authentication server': src/api/core/two_factor/mod.rs:273 ```
OVERLORD added the bug label 2025-10-09 16:35:01 +03:00
Author
Owner

@Subito commented on GitHub:

Of course, just catching the error would be great. As you said: Any sort of queue-and-retry should be handled on a mailserver. But panicing on a simple SMTP-Error is probably not great. Just logging an error would be perfect.

@Subito commented on GitHub: Of course, just catching the error would be great. As you said: Any sort of queue-and-retry should be handled on a mailserver. But panicing on a simple SMTP-Error is probably not great. Just logging an error would be perfect.
Author
Owner

@BlackDex commented on GitHub:

Vaultwarden does not have a retry mechanisch for these kind of scenarios. The message indicates a connection error.

Most of the time temp errors should be tried again after a few minutes, but this is not something Vaultwarden handles. I also do not thing Vaultwarden should handle those and try again actually. That kind of functionality belongs to mail servers, not clients.

We probably can catch this error and return an error instead of a panic though, that is probably nicer then a panic.

@BlackDex commented on GitHub: Vaultwarden does not have a retry mechanisch for these kind of scenarios. The message indicates a connection error. Most of the time temp errors should be tried again after a few minutes, but this is not something Vaultwarden handles. I also do not thing Vaultwarden should handle those and try again actually. That kind of functionality belongs to mail servers, not clients. We probably can catch this error and return an error instead of a panic though, that is probably nicer then a panic.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#504