search

ajrosen / Bitwarden-Accelerator

Alfred Workflow to make using Bitwarden faster and smoother with all applications
GNU General Public License v3.0
44 stars 1 forks source link

Login flow asks for Yubikey OTP but its presence is ignored #15

Open blacs30 opened 3 months ago

blacs30 commented 3 months ago

I have Yubikey OTP configured, the login flow asks for me to touch it. By accident I entered some other text but then I noticed that the workflow had me logged in anyway. I guess but haven't confirmed it that I am still logged in according to Bitwarden but the workflow, after a restart of my machine, asks me to login again. Somewhere there is a bug. Either it really needs to log me in but then a wrong Yubikey OTP should prevent it or the workflow should detect that I am already logged in just need to unlock Bitwarden.

ajrosen commented 3 months ago

I just tried it and got "Two-step token is invalid. Try again." as expected.

The workflow checks with Bitwarden for its current state every time it's called, so it should never disagree about your login state. State is defined by whatever curl -s http://localhost:8087/status returns. If bw serve is not running/listening on port 8087, then you are are "unauthenticated" (logged out).

What I did find is it's possible to call the workflow a second time before the first "flow" is finished.

  1. bw login
  2. Enter Bitwarden username
  3. Enter Master password a. bw login
  4. Touch YubiKey
  5. Get "You are logged in!" notification b. Enter Bitwarden username c. Enter Master password d. Enter garbage for YubiKey e. Get this malformed "You are logged in!" notification

{"success":true,"data":{"object":"template","template":{"serverUrl":null,"lastSync":"2024-08-03T14:43:20.912Z","userEmail":"user@example.com","userId":"00000000-0000-0000-0000-000000000000","status":"locked"}}}You are already logged in as user@example.com.

Could that have happened in your case?

blacs30 commented 2 months ago

I missed the notification of your response. Will check more in detail and report back.

blacs30 commented 2 months ago

I updated to the latest version.

{"success":true,"data":{"object":"template","template":{"serverUrl":null,"lastSync":"2024-08-03T14:43:20.912Z","userEmail":"user@example.com","userId":"00000000-0000-0000-0000-000000000000","status":"locked"}}}You are already logged in as user@example.com.

Could that have happened in your case?

Yes that is what happens to me after a reboot of the system.