Fido2/Webauthn not working

[ascii78]

After installing vaultwarden I can't seem to get fido2 working, setting the 2fa seems fine in the webinterface and there's a checkbox in admin section under my user.

I run a default docker install behind a nginx proxy server. I have disabled custom error messages as reported in some tickets. Checking in the browser tab under network response it does give a json error request:

{"MasterPasswordPolicy":{"Object":"masterPasswordPolicy"},"TwoFactorProviders":["7"],"TwoFactorProviders2":{"7":{"allowCredentials":[{"id":"vEwvaetc","type":"public-key"}],"challenge":"GvWpdwetc","extensions":{"appid":"https://vw.example.com/app-id.json","getCredBlob":false},"rpId":"vw.example.com,"timeout":60000,"userVerification":"discouraged"}},"error":"invalid_grant","error_description":"Two factor required."}

(changed domains).

I have enabled logging in the vaultwarden image, the error message is "2fa token not provided"
2025-01-16 10:40:45.362][request][INFO] GET /api/devices/knowndevice [2025-01-16 10:40:45.363][response][INFO] (get_known_device) GET /api/devices/knowndevice => 200 OK [2025-01-16 10:40:48.717][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins [2025-01-16 10:40:48.717][vaultwarden::api::core::accounts][DEBUG] Purging auth requests [2025-01-16 10:40:48.717][vaultwarden::api::core::two_factor::duo_oidc][DEBUG] Purging Duo authentication contexts [2025-01-16 10:40:53.266][request][INFO] GET /alive [2025-01-16 10:40:53.266][response][INFO] (alive) GET /alive => 200 OK [2025-01-16 10:40:56.939][request][INFO] POST /identity/accounts/prelogin [2025-01-16 10:40:56.940][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK [2025-01-16 10:40:57.007][request][INFO] POST /identity/connect/token [2025-01-16 10:40:57.312][error][ERROR] 2FA token not provided [2025-01-16 10:40:57.312][response][INFO] (login) POST /identity/connect/token => 400 Bad Request

[BlackDex]

That is how it works. The Bitwarden clients act upon a 400 message and return the available options to provide a 2FA.
After which your client should present you the options.

If it does not, then you probably have your reverse proxy or tunnel configured in such a way that it intercepts these messages and changes them in some way.

With Vaultwarden v1.32.7 you can see if this is the case by going to /admin/diagnostics and check for errors there.

[ascii78]

ah that diagnostics page is usefull, the http response validation is green though. I asume that's where the check is. I'm going to check my client side setup first since this is the first time i'm using fido2. I previously used the yubikey only for keepassxc but that does not use fido. I have enabled OTP, that works. If I can't get fido2 to work I'll be changing to OTP which is sufficient.