Closed Ironfist69 closed 1 month ago
Additional context — this is related to an issue that was recently described by this user on the Community Forum and on Reddit.
However, I don't think that the steps described by @Ironfist69 above cause actual destruction or corruption of the vault data or metadata (e.g., the protected key) by themselves. @Ironfist69, you noted that after you "logged out & re logged in using [your] email id, master password and TOTP ... [your] vault is perfectly fine." Thus, the vault items were not in fact "destroyed", they just failed to display (possibly due to a decryption failure).
The bigger question is whether the passkey failure reported here was a causative factor in the corruption of OP's vault after the account email address was changed (as described in the Community Forum thread).
https://github.com/bitwarden/clients/assets/70436487/2fc6fe5d-ddd3-4a28-8707-adf2c6679c47
This one is occurring after entirely removing the passkey and re-created the passkey (changed kdf iterations also), used that new passkey as login.
@Ironfist69 Thank you for the latest video, and for the feedback on this issue. We are looking into it.
Just to make sure we understand what we're seeing in the latest video and any potential steps you did that could be causative factors, you:
Is that correct? If so, in step #6, would you be able to check your console logs to see if you see any errors in that tab?
Thank you for your help.
@Ironfist69 Thank you for the latest video, and for the feedback on this issue. We are looking into it.
Just to make sure we understand what we're seeing in the latest video and any potential steps you did that could be causative factors, you:
- Logged in with master password
- Changed KDF iterations on your account
- Removed the passkey from Bitwarden and re-added it
- Logged in using that passkey successfully
- Opened another tab
- Attempted to log in with that passkey and saw an empty vault Is that correct? If so, in step https://github.com/bitwarden/clients/issues/6, would you be able to check your console logs to see if you see any errors in that tab?
Yup
would you be able to check your console logs to see if you see any errors in that tab?
An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing. insertBefore @ dom_renderer.ts:190 api.service.ts:1603 Refused to connect to 'https://api.bitwarden.com/config' because it violates the following Content Security Policy directive: "connect-src 'self' wss://notifications.bitwarden.com https://notifications.bitwarden.com https://cdn.bitwarden.net https://api.pwnedpasswords.com https://api.2fa.directory/v3/totp.json https://api.stripe.com https://www.paypal.com https://api.braintreegateway.com https://client-analytics.braintreegateway.com https://*.braintree-api.com https://bitwardenxx5keu3w.blob.core.windows.net https://app.simplelogin.io/api/alias/random/new https://app.addy.io/api/v1/aliases https://relay.firefox.com/api/v1/relayaddresses/ https://api.fastmail.com https://quack.duckduckgo.com/api/email/addresses https://api.forwardemail.net".
(anonymous) @ zone.umd.js:1574
C.a.
(anonymous) @ zone.umd.js:1574
C.a.
(anonymous) @ zone.umd.js:1574
C.a.
(anonymous) @ zone.umd.js:1574
C.a.
provided the entire console log.....suddenly triggered this issue again
This issue will be resolved with #9517, which will be released in the next release of the web client scheduled for this week. As this has been merged, I am closing this ticket. If you continue to experience the issue please feel free to re-open.
Thank you for your patience!
Steps To Reproduce
Log in into Bitwarden webvault by using passkey, it'll look like this
Expected Result
It should not corrupt login entries
Actual Result
It's emptying login entries (like in the screenshot) and syncing across all devices.
Screenshots or Videos
Uploaded the footage, but cropped the last part, bcz it's showing my vault (Shared the original footage with bitwarden support)
https://github.com/bitwarden/clients/assets/70436487/f8ec8ec3-0cc1-4df1-93ed-36422af7a603
Additional Context
✅️ Workaround I used: I quickly logged out & re logged in using my email id, master password and TOTP. My vault is perfectly fine. It’s only happening when I’m using passkey to login into Web Vault
Operating System
Android
Operating System Version
Android 14 (OneUI 6)
Web Browser
Chrome
Browser Version
No response
Build Version
Chrome 122.0.6261.105
Issue Tracking Info