Tree: 6347d1d26e

cached-config-operations

main

revert-7033-patch-1

test_dylint

v2-1-blob-ciphers-key-ids

v2-2-registration

v2-3-key-rotation

v2-4-sdk-live-tests

v2-registration

0.10.0

0.11.0

0.12.0

0.13.0

0.9.0

1.0.0

1.1.0

1.10.0

1.11.0

1.12.0

1.13.0

1.13.1

1.14

1.14.1

1.14.2

1.15.0

1.15.1

1.16.0

1.16.1

1.16.2

1.16.3

1.17.0

1.18.0

1.19.0

1.2.0

1.20.0

1.21.0

1.22.0

1.22.1

1.22.2

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.25.2

1.26.0

1.27.0

1.28.0

1.28.1

1.29.0

1.29.1

1.29.2

1.3.0

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.32.6

1.32.7

1.33.0

1.33.1

1.33.2

1.34.0

1.34.1

1.34.2

1.34.3

1.35.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.36.0

1.37.0

1.37.1

1.37.2

1.37.3

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.9.0

1.9.1

Branches Tags

${ item.name }

Create tag ${ searchTerm }

Create branch ${ searchTerm }

from '6347d1d26e'

${ noResults }

Commit Graph

2 Commits (6347d1d26ecb275fd4fe4a138df5f2eaad6e0ea2)

Author	SHA1	Message	Date
nathanmoreton	aa25c221e9	Document the SSO cookie vendor and fix clippy on Rust 1.98 Bring the documentation this feature ships with in line with the Google developer documentation style guide, and clear the one lint the toolchain bump surfaced. No behavior changes. Documentation: * Add a module header to sso_cookie_vendor.rs explaining the flow, why it exists, and that the route is registered only when the feature is on. Rewrite the item docs in descriptive third person and give each fallible function an `# Errors` section naming every status code and the condition behind it. Replace the comments that restated the code with ones that explain why the cookie map is built, why the length cap is applied to the finished link, and why shard order is deterministic. * Comment the two additions in api/core/mod.rs, restoring the upstream bitwarden/server#6892 reference that was dropped along with the `"communication": null` placeholder. * Rewrite the admin-panel help text and .env.template entries so they say when an operator needs the setting, not just what it is. * Rewrite docs/sso-cookie-vendor.md: sentence-case headings, a settings table, numbered procedures, explained placeholders. It now states that Cloudflare Access is the only proxy verified in production rather than implying the others are tested. Fixes: * `cookie.value().to_string()` twice becomes `to_owned()`, which clippy::str_to_string began rejecting after the toolchain moved to 1.98. * Rename test_uri_too_long_returns_400 to test_oversize_cookie_exceeds_uri_limit. It asserts that the built URI exceeds the cap; the 400 comes from the handler, which the test never calls. * The validation error now names `SSO_COOKIE_VENDOR_ENABLED` instead of describing it in prose, so the reader knows which flag to unset. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YXT28rZFFFahdfKXJScPHy	3 weeks ago
nathanmoreton	2b79525441	Add SSO cookie vendor endpoint for native apps behind authenticating proxies Implements the server-side pieces of Bitwarden's SSO cookie vending flow (upstream PRs bitwarden/server#6880, #6892, #6903) so the native Bitwarden mobile and desktop apps work when Vaultwarden sits behind an authenticating reverse proxy such as Cloudflare Access, Authentik, Authelia, or oauth2-proxy. Without this, users behind such a proxy can authenticate the web vault in a browser but the native apps 404 on /api/sso-cookie-vendor after the browser-assisted IdP step, leaving the app unable to acquire the proxy's auth cookie. What's added: * New config section `sso_cookie_vendor` (4 fields, default-off) driving both env-var and admin-UI configuration via the existing make_config! macro, with startup validation. * GET /api/sso-cookie-vendor — reads the proxy auth cookie from the request (including sharded variants CF_Authorization-0..19) and 302-redirects to bitwarden://sso-cookie-vendor?<cookie>=<value>&d=1 so the native app can capture and reuse the cookie. Upstream-compatible 404/400/500 HTML error pages; 8192-byte URI cap. * communication.bootstrap block in /api/config matching the shape from bitwarden/server#6892 so clients discover the flow without modification. * Unit tests covering single/sharded cookies, precedence, missing-cookie 404, URL-encoding, oversize URI, and error HTML format. See docs/sso-cookie-vendor.md for the full writeup (background, security considerations, end-to-end flow, and per-proxy configuration notes).	5 months ago