2FA "Remember me" doesn't work after upgrade

[Klaaktu]

After the web vault was upgraded to 2024.5.1, I was prompted for 2FA code again, but every time I log in it asks me again even though I ticked "Remember me". How can I find out what's wrong?

[BlackDex]

It seems to work fine for me.
Make sure you do not have any extension which clears/blocks cookies or local storage.

Try with a different browser or different browser profile which does not have any extension installed.

[Klaaktu]

I re-downloaded the image (latest-alpine) and started a new container, then tried on another PC with Chrome and never-opened-before Edge, but it's still the same.
Indeed there is never any cookie being stored. POST to /identity/connect/token returns 400:

[request][INFO] POST /identity/connect/token
[error][ERROR] 2FA token not provided
[response][INFO] (login) POST /identity/connect/token => 400 Bad Request

[Klaaktu]

Unfortunately I couldn't find out what was wrong. I nuked my persistent data and started over with the same config.json, now the problem is gone.
The correct POST request to /identity/connect/token is indeed supposed to have a "twoFactorToken" field, which the old ones didn't have for some reason.

p.s. While I was at it, I also switched from using bind mount to volume, not sure if it's that which fixed the issue...

[schmitz-ens]

I just want to point out that I have exactly the same problem (Firefox/Chrome) on 2 different instances of Vaultwarden since the 2024.6.2b update.

[BlackDex]

Nothing has changed in regards to this, so it would be unlikely something which was changed in Vaultwarden.
Most of the time it's an issue with date/time out of sync, or reverse proxies or add-ons which filter/modify requests and causes headers or arguments to be filtered or removed.

[BlackDex]

Or, browsers/add-ons which forget all cookies/local storage. That is also a common issues.