Browser extension URL validation does not recognize duofederal.com

cmarks-ves commented 3 months ago

Steps To Reproduce

Preconditions:

Customer is using Duo Federal.
Server or account is configured to use Duo for MFA

Steps to reproduce:

Log into the browser extension like normal (e.g., using email address and master password).
When prompted to perform Duo MFA, open the popup.

Expected Result

The popup renders the Duo iFrame and MFA is completed successfully.

Actual Result

The popup has a spinning wheel and no Duo popup.

Screenshots or Videos

No response

Additional Context

duofederal.com is Duo's FedRAMP environment for US government users, which is separate from Duo's generally available environment.
This was found in Edge on Windows 11, but I suspect this applies across the board to any OS/browser combination.

Operating System

Windows

Operating System Version

11 23H2

Web Browser

Microsoft Edge

Browser Version

Version 126.0.2592.113 (Official build) (64-bit)

Build Version

Extension Version: 2024.6.2, Server version (self-hosted): 2024.4.1

Issue Tracking Info

[X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

cmarks-ves commented 3 months ago

This is the line which threw the exception in the browser console: https://github.com/bitwarden/clients/blob/main/apps/web/src/connectors/duo-redirect.ts#L55

Neonwarden commented 3 months ago

Hi there,

I am unable to reproduce this issue, but it has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

trmartin4 commented 1 month ago

Hello! We have added duofederal.com as a valid redirect. This has been fixed with https://github.com/bitwarden/clients/pull/11137 and released in the latest Bitwarden web client release (2024.9.2).

bitwarden / clients