"Wrong username or password" on 1.27.0-9366e314 with browser extensions

[x86-39]

Subject of the issue

I get an error "Wrong username or password" when trying to log in with the browser extension.

Deployment environment

• vaultwarden version:
  Server Installed:
  1.27.0-9366e314
  Web Installed:
  2023.1.1
  Database
  SQLite: 3.39.2

• Install method: https://github.com/constin/vaultwarden-helm in k3s with ArgoCD

• Clients used: Web vault, extension, Android app

• Reverse proxy and version: Traefik

Steps to reproduce

I'm using the following values:

vaultwarden:
  image:
    repository: vaultwarden/server
    tag: testing
    pullPolicy: IfNotPresent

  env:
    SIGNUPS_ALLOWED: false
    INVITATIONS_ALLOWED: true
    DOMAIN: https://vault.example.com
    SMTP_HOST: example.com
    SMTP_FROM: no-reply@example.com
    WEB_VAULT_ENABLED: true
    ADMIN_TOKEN: "< TOKEN >"

  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: traefik
      kubernetes.io/tls-acme: "false"
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.tls: "true"
    path: /
    hosts:
      - vault.example.com
    tls:
      - secretName: vaultwarden-example-cert
        hosts:
          - vault.example.com
    pathType: Prefix

  persistence:
    enabled: false
    accessMode: ReadWriteOnce
    size: 3200Mi
    storageClass: longhorn-replicated
    #existingClaim: "bitwarden-pvc"

Expected behaviour

I can log in with the web extension.

Actual behaviour

I tried it on Firefox and Chromium, it happens on multiple devices. I can log into the web vault and on Android apps. My account is set up with an authenticator app and FIDO2. The web browser extension version is 2023.1.0

Troubleshooting data

In server logs:

[2023-01-30 18:52:53.374][request][INFO] GET /api/v1/instance
[2023-01-30 18:52:53.374][_][WARN] Response was `None`.
[2023-01-30 18:52:53.374][_][WARN] Responding with registered (api_not_found) /api 404 catcher.
[2023-01-30 18:52:53.374][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found

There are no relevant logs in Traefik.

This is a fresh install, not a migration from a previous version. I tried it on a fresh browser, so it doesn't seem to be cache.

[BlackDex]

v1/instance looks like a k8s/traefik thingy to me. There is no endpoint with that for Vaultwarden/Bitwarden as far as i know.

Are you sure you configured the correct host for the browser extension via the gear icon?

[x86-39]

I just found the issue, the host was correct.

Somehow this was caused by the lack of a persistent volume. I don't know how the web UI still worked fine, but something specifically about browser extensions caused it to fail without a persistent volume, even though the container never restarted and would still work on mobile / web during all this. Just adding back the persistent volume (I had set persistence to false for testing) fixed it..

[BlackDex]

It probably did do a restart. And the clients do cache the vault data.

[x86-39]

Maybe yeah. I'm sure I still saw the user in the admin portal, so that's weird