Using Bitwarden's push service

[GeekCornerGH]

Hi everyone, I might have an idea to add mobile push notifications to vaultwarden.

Bitwarden is using push.bitwarden.com to send the notifications. However, it only does work with official server. So I got this idea to maybe add it to Vaultwarden. Sadly I never used Rust, so I won't be able to make it myself.

To be able to setup push notifications, Bitwarden require an installation id and an installation key that can be found here.

How it can be done :

• Looking at official server's code, to see how push notifications works
• Add an optional option that prompt Installation credentials
• If the option is enabled, then send push notifications the same way as official server

Thank you for this amazing project, and have a good day

[BlackDex]

I'm not sure if we want to support this, and if Bitwarden would allow/appreciate that third-party backends use there push services.
Adding this does mean a higher burden on there push services and if they make changes we will always run behind.

Also, since the mobile client does support auto-sync on startup it kinda isn't that of a necessity i think.
Though, having it and enabled could be nice.

[GeekCornerGH]

I'm not sure if we want to support this, and if Bitwarden would allow/appreciate that third-party backends use there push services.

Didin't thought about this, I might open a thread on the official forum.

Adding this does mean a higher burden on there push services and if they make changes we will always run behind.

I never told this would be mandatory, I said it would be cool to have this feature

Also, since the mobile client does support auto-sync on startup it kinda isn't that of a necessity i think.

I often have desktop app and mobile app runing at the same time :/

Though, having it and enabled could be nice.

Yeah I agree

[lostwindsenril]

Hi, I support your proposal. This feature is really required.

Also, since the mobile client does support auto-sync on startup it kinda isn't that of a necessity i think.

In my own experience of bitwarden iOS, auto-fill is used much more frequently than looking up and copy a password in app.
However, without push notification, sometimes auto-fill passwords was outdated, forcing me to open the app and refresh.
Anyway, vaultwarden is already an awsome porject. Having this feature makes it even better, I think.

I'm not sure if we want to support this, and if Bitwarden would allow/appreciate that third-party backends use there push services.

I've find your thread on the bitwarden forums, and it doesn't look like they are against us doing this. However, they didn't give a clear answer at last, just said "contacting Bitwarden support with your question".
I don't know what answers they gave you, but I'm interested in this discussion. Hope to hearing from you about the progress.

[GeekCornerGH]

I'm still waiting for an answer from their team

[paulthvt]

@GeekCornerGH did you get any answers from their team? With the passwordless coming in Bitwarden it would be great to use their push server.

[GeekCornerGH]

They didn't stated anything official

[paulthvt]

Ok thx. That's sad..

[pc-coholic]

I know that there was a thread posted on the Bitwarden Community Forums, that never got anywhere.

When I recently started to toy around with my own implementation of a Bitwarden-compatible backend (because who doesn't love reinventing the wheel?), I also stumbled upon the thread and also the discussion in #126 as well as #246.

I did contact Bitwarden Support by eMail, explained that I was using a third party backend and asked

Do you impose any restrictions on who is allowed to use push.bitwarden.com or is anyone who is willing and capable to send properly crafted push-requests to it allowed to do so?

The answer was

After consulting with my team, ​it looks like you are fine to utilize the push relay as long as it is not abused. Please feel free to reach out with any additional questions or concerns!

So I think this qualifies as an official statement where using the push relays are fair game?

[BlackDex]

That would be nice indeed. It's only for the mobile clients.
And i think you still need a Bitwarden self-hosted key for this, so that does limit the abuse, and easy to block when it is for them.

[GeekCornerGH]

Interesting, they didn't replied to me, thanks for bumping this

[GeekCornerGH]

That would be nice indeed. It's only for the mobile clients.
And i think you still need a Bitwarden self-hosted key for this, so that does limit the abuse, and easy to block when it is for them.

Yep, you need, else you cann't use it

[GeekCornerGH]

#3304 🎉

[cure1245]

I'm also noticing that it's not pushing. I have reinstalled my app, deleted old device records in mysql, and loggedout and back in. The push fields in the devices table never get any values: all devices show NULL.

[BlackDex]

Same for me using v2023.5.0. Not yet tested v2023.4.0.

[varunpan]

I was able to test a number of things including sharing on orgs and able to confirm that iOS push and websocket changes between browsers are working as expected. So far so good. 😄

[ShlomiD83]

Deployed the latest testing build and push is working great on my android app, slowness gone and items are syncing instantly.
Thanks again!

[knightian]

Push seems working with server v1.28.1-44e9e1a5 and latest iOS official app

Test method: created secure note in Windows desktop app, it appears instantly in iOS app. Deleting note from Windows desktop app instantly deletes from iOS app.

[darkman242]

The PUSH does not work for me either. PUSH_UUID and PUSH_TOKEN in the device table are also empty.
I use Traefik without websocket configuration for Vaultwarden. Ports 80/443 are forwarded to the VW container from the router.
What can I do?

[darkman242]

Yes, PUSH is activated, INSTALL ID and INSTALL KEY have been newly created and entered via https://bitwarden.com/host/. These values are in the admin web page under ReadOnly. Is there anything else to test?

[quexten]

Did you clear the device data? On android clearing storage of the app, and on iOS uninstalling and re-installing is required. The registration only happens when your device is unknown to the server.

[darkman242]

Yes, I did that - without success.
But now it works. I had previously used "Deauthorize sessions" via the user's WebVault under AccountSettings/MyAccount. However, the devices in the database were not cleaned. After I executed "Deauthorize sessions" for each user in the admin page under users, the devices were cleaned in the database. After that, I re-registered my Android phone and now I have PUSH_TOKEN/PUSH_UUID.

Thanks for the feature

[xKugeki]

Hey @darkman242
Did you tested that with iOS aswell ?
Tried your steps but 'push_token' still emtpy :/

anything u changes on your reverse proxy ? or env?

[darkman242]

@xKugeki
iOS works the same way for me. I have not made any changes to the reverse proxy.
I have only added the following as an environment.

• PUSH_ENABLED=true
• PUSH_INSTALLATION_ID=
• PUSH_INSTALLATION_KEY=

I got the ID/KEY from https://bitwarden.com/host

[cryptoluks]

Thanks for the great feature! Works great on iOS after app reinstallation.

However, it seems to only work for items inside the personal vault, not for creating/editing/deleting in a organization/shared vault?!

Is this the expected behavior?

[JuliDi]

Clearing cache and killing the app didn't do it for me on Android 12. Full reinstall via Play Store did the trick, however. Thanks for the PR!

[kpfleming]

Same here... uninstall/install and the login resulted in a push_uuid in the devices table.

[hiyan]

Tried many things, nothing worked. Deleted the app and reinstalled from Play Store, now Push is working.

[kobimx]

On the topic of organization/shared vaults, the website says that items sync every 30 mins for such type of vaults
Is this feature implicitly implemented in the latest release or does it need extra work?

[BlackDex]

That is done client side as far as i know

[TKruzze]

Loving the new PUSH Sync on my devices! One thing I did encounter was that the feature doesn't seem to be compatible with the F-Droid version of the Android app. Once I removed it and installed the Play Store version, everything worked perfectly.

[Bloodpack]

Thank you for the hard work to implement PUSH!!

It works for me on Android after clearing the storage of the Bitwarden-App on my phone.

maybe it should be mentioned in the release notes or so.......

[fxzxmic]

Yes, I also wonder why it hasn't worked.

[ados8]

I've been unable to get it working for Android.
Variables set and even cleared phone app data with reinstall.
Syncs only if I swipe down/manually sync.

Edit: I have reset phone app data 5+ times with reinstall
Deauthorised account sessions and even all users
Restarted docker many times and even forced latest update tag to install again
Since I'm using SQL lite and not dedicated backend I don't know how to inspect the database

[Bloodpack]

@ados8
are you maybe storing your secrets in an organisation?

Org items are not synced via push, this is not supported by bitwarden (i did read it somewhere here by i don´t find it anymore....)

[ados8]

@Bloodpack to save time I've already tried everything mentioned in this posting and much more ☺️. One last attempt is to bypass my proxy completely and test.

[ados8]

I've now completed a clear of mobile app data, reinstall and used my internal IP for server address to bypass the proxy.
No push working, requires manual sync to see new folder or password.
This was all done with brand new testing account, I have run out of tests and at this point have reinstalled the app at least 10 times.

[ados8]

The only thing that could be the issue is the website phrasing "Select the data region that corresponds to your existing Bitwarden account." I don't have an account with them, only an account for the community forum. However, no one has mentioned this is required and keys were provided to me all the same.

[ados8]

I finally found the solution!
As a security conscious person I chose EU as the region for the keys (the option is there).
The EU region has much stricter privacy laws, arguably the best in the world at the moment.
However, the keys don't work for push.bitwarden.com and there is no push.bitwarden.eu
This information was identified here #3731 and I have verified.
As soon as I obtained new keys from US region it worked immediately.
Sadly this is not specified in the wiki and wasted a lot of time troubleshooting.

[GlenLowland]

Push notifications will only work on Bitwarden app installed from the official mobile stores (App Store, Google Play Store) or when using alternative clients for the Google Play Store (such as Aurora Store). Push notifications will not work on Bitwarden installed from F-Droid, NeoStore or alternative stores.

[BlackDex]

It was already mentioned, but thanks for the better clarification.

[ados8]

Was hoping (greedy 😋) that with push the approve login request would work.

However, push is working and I have setup approve login requests but there is no option when logging into Vaultwarden.
Is this an additional feature request that will be needed?

[quexten]

There is a pull-request for this feature.

[BlackDex]

I tested it yesterday, and it works (with some adjustments). I received a popup/notification when i clicked that button.

[Daniel-MFG]

With some adjustments?
Is this already doable with simple config changes in version 1.29.1 or will we have to wait for a future update?

[quexten]

You have to wait for the PR to get merged, after that, it will work out of the box.

[Daniel-MFG]

So another update?
Ooh well - i can wait for that...

Thanks for the great work!

[shubham399]

On DN2101 I tried, Deauthorize sessions, Uninstall and Reinstall of Bitwarden Application on Android Version 2023.7.0(6781) (application) Android 13.
Still No Push Token/PUSH UUID

PUSH Installation ID and Key are present

Server Version

[shubham399]

It uses the Bitwarden cloud and Google API via the Play Store to reach your mobile. On that subject, it has been specified you must install using the store app not third party.

Installed the application from Google PlayStore (Fresh Install Every-time I am checking (With Session DeAuthorized from Admin panel.)

[ados8]

If your using environmental variables to enable websockets please remove and try.
If still an issue than likely your proxy.

[shubham399]

Does the application need to be in US region for this work? Currently the application itself is hosted in Asia Region

[ados8]

Nope not region restricted.
Just the US only API works.
Either your proxy or firewall.

[shubham399]

If your using environmental variables to enable websockets please remove and try.
No That Is not set

If still an issue than likely your proxy. > will check that

[shubham399]

Saw a issue with proxy and fixed that.

2023-08-16T09:47:13Z app[9080e473b50787] bom [info][2023-08-16 15:17:13.092][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL
2023-08-16T09:47:13Z app[9080e473b50787] bom [info][2023-08-16 15:17:13.092][vaultwarden::api::notifications][INFO] Accepting Rocket WS connection from 1.2.3.4
2023-08-16T09:47:13Z app[9080e473b50787] bom [info][2023-08-16 15:17:13.093][vaultwarden::auth][ERROR] Error decoding JWT
2023-08-16T09:47:13Z app[9080e473b50787] bom [info][2023-08-16 15:17:13.093][vaultwarden::api::notifications][ERROR] Invalid token
2023-08-16T09:47:13Z app[9080e473b50787] bom [info][2023-08-16 15:17:13.093][response][INFO] (websockets_hub) GET /notifications/hub?<data..> => 401 Unauthorized
2023-08-16T09:47:15Z app[9080e473b50787] bom [info][2023-08-16 15:17:15.579][vaultwarden::api::identity][INFO] User [email protected] logged in successfully. IP: 1.2.3.4

Should I be concerned about this?

[shubham399]

Tried on a different Device for Different User and that has PUSH_TOKEN and PUSH_UUID

[gitty85]

Hi,
I have been playing around with this on my mobile which is running the latest version of iOS. I can only seem to get it working if the Bitwarden app is running in the background, if the app is closed then nothing will update. Is this by design or am I missing something?

[BlackDex]

You can discuss this here, but we probably do not have the answers you are searching for. We do not maintain the push services. We only use it. I do not think there is anyone here who as deep knowledge on how the clients exactly work in regards to this specific feature.

So, if someone knows the answer, that would be great, else i wouldn't expect a very detailed explanation from someone on how this works.

The basics are, if you device has a push token in the Vaultwarden database, and the push key/id are correct and working, then Vaultwarden tries to send a signal to the Bitwarden push servers, after that, it's out of our control. And if and how that is handled is outside of our control.

If you really want the details, i would suggest to read the code on the Bitwarden Server repo and check how it works.
And if you figured it out, it would be cool if you can share that with the rest of us :)

[gitty85]

@kpfleming I will create an account and see what it does.

[gitty85]

@BlackDex I was only wondering if the behaviour I am seeing is correct on iOS. That being the app has to be running in the background.

[gitty85]

I have created an account at Bitwarden.com I will give it 24 hours but currently I am not getting any push updates so its likely I need to wait for the sync to run.

[ados8]

@gitty85 found people mentioning this on their forum going back years. One suggestion is the app needs to be allowed for push and all settings in the iPhone. After that login to the app. Did you login to the app first before allowing allow settings? All I can say to help as I'm Android.

[phobiac]

Would it be possible to have this feature's variables editable through the admin page?

[GeekCornerGH]

Probably not, like the legacy websockets option

[phobiac]

Is there something about the implementation that prevents it from being configurable that way? I understand what you're saying with the legacy websockets option, but that's a legacy feature.

[GeekCornerGH]

I don't think api credentials should be editable unless you have console access to the host machine

[gerootech]

May I ask how to add the installation ID and key to the vault ? also do I need a connection allowed back to my server from the bitwarden.com ? as my server is available only through my network.

[quexten]

also do I need a connection allowed back to my server from the bitwarden.com ? as my server is available only through my network.

Bitwarden's servers do not need to establish a connection to your server. So having your Vaultwarden instance exposed only on your LAN is fine. However, your server needs to be able to establish an outgoing https (tcp) connection to Bitwarden's push server.

You do not add the id and key in your user vault. Instead you add them as an environment variable where you hosted your server (e.g docker compose, or whatever method you use to run Vaultwarden).

[gerootech]

Thanks for the quick response, I use docker to install my Vaultwarden, is this something I add to the docker install command with options, same like i add the admin token using -e ADMIN_TOKEN ? Sorry I am not an expert just knows the basic on how to install it.

[quexten]

Yes, you additionally need -e PUSH_ENABLED=true -e PUSH_INSTALLATION_ID=... -e PUSH_INSTALLATION_KEY=.... If you want login-with-device to be working, you also need the latest testing image instead of the latest stable release.

[gerootech]

thanks

[gerootech]

I am getting the notification on my phone but when I say approve it says "We were unable to process your request. Please try again or contact us"

I am running the following versions:
Server Installed Ok
1.29.2
Server Latest
1.29.2
Web Installed
2023.7.1

so it is not the latest testing though, could this be the problem

[quexten]

I am getting the notification on my phone but when I say approve it says "We were unable to process your request. Please try again or contact us"

I am running the following versions: Server Installed Ok 1.29.2 Server Latest 1.29.2 Web Installed 2023.7.1

so it is not the latest testing though, could this be the problem

Yes, as previously mentioned:

If you want login-with-device to be working, you also need the latest testing image instead of the latest stable release.

[gerootech]

thanks again.

[RainrZufall]

Hello,
I have configured the websocket and the data is successfully and automatically synchronized with all clients and web.

Now I wanted to activate push notifications for iOS.

But I get this error message:

bitwarden | [2023-11-06 10:37:10.605][vaultwarden::api::push][ERROR] Error getting push token from bitwarden server: error sending request for url (https://identity.bitwarden.com/connect/token): error trying to connect: tcp connect error: Cannot assign requested address (os error 99)

Does anyone happen to have an idea?

[RainrZufall]

no problem?

[BlackDex]

Seems to be working indeed.
Could you enable log_level=trace and try again?
Hopefully that gives some more info.

[RainrZufall]

@BlackDex
Does the log file contain sensitive data?

[BlackDex]

With trace it could. SMTP password is an option. And in this case maybe your push id/key. So yes that might be possible.

[RainrZufall]

OK, I couldn't find anything problematic.

I use 9.9.9.9 or 1.1.1.1 as DNS
I don't actually have any problems with DNS requests.
I've already reinstalled the iOS app 5 times, so I don't think that could be the problem :D

In the test I completely restarted the container (docker compose down + docker compose up -d). Then I manually synced the vault on my phone (iOS) and in the desktop app (Windows).

Then I renamed a folder in the vault using the desktop app and waited briefly to see whether a notification was sent.

I then checked the folder change on my phone. It was done without me having to synchronize the vault again. But I didn't receive a message either.

vaultwarden.log

[rubenixnagios]

same here, android 11 & cannot make push notification to work. reinstalled several times and same. It does work with web vault & windows app, so its not reverse proxy nor pihole, I think must be some kind of android related issue (tried with two android phones and one tablet). different android versions.

Tried also with latest and testing image container versions on arm64

hope some day I can make it to work!!

[BlackDex]

There arn't any updates yet to refer too, just some stuff in my head.

[rubenixnagios]

will try few things have in mind too and post feedback here!

[BlackDex]

Debugging is actually only possible via a mitmproxy and by checking the database to see if your devices have a push-token.

[rubenixnagios]

how can I check the database to verify device has a push token? using sqlite btw
tx @BlackDex

[rubenixnagios]

nevermind got it to work!! recreated the installation ID & key, recreated container deautorized again not just my account but all user accounts in bw and bum; working as expected; client push working on android!! so happy!! TX!

[gitty85]

Hi,
I have the same issue with iOS and have noticed that if I leave the app running in the background push notifications work. If I force close it they do not which is fine for other apps. Can you do a similar thing on Android? The other test I did was to create a free account on the bitwarden site itself and was able to recreate the same issue so it may not be vaultwarden specific.

[BlackDex]

If you have the exact same behavior with vault.bitwarden.com, then it probably is not a Vaultwarden issue, but a works-as-intended, or a bug.

[Murguth]

Well guys... I'm not a coder. I'm just an enthusiast. I can't set those variables since I can find them in the Admin page in the Read-Only Config area. This is driving me crazy.
Could someone please explain in simple and basic terms (I'm not an English fluent speaker, however) how can I put the Intallaton ID & Key values in the right fields? I have the 2 strings already. I'm not just able to input them.

TY all for your kind (and easy to understand) instructions.

[quexten]

You do not set them on the admin page. Instead, you set them as environment variables. For example, if you set up vaultwarden using docker-compose, then you have to edit your docker-compose.yml file.

[Murguth]

You do not set them on the admin page. Instead, you set them as environment variables. For example, if you set up vaultwarden using docker-compose, then you have to edit your docker-compose.yml file.

I installed it via Portainer following an online guide. 😅

[quexten]

I don't know much about Portainer, but a quick google search gives many guides on how to set environment variables there. For example: https://www.techrepublic.com/article/add-environment-variables-container-portainer/

[Murguth]

I DID IT! I DID IT!!!!

TY SO MUCH!!!!!

[andres-asm]

I am getting the notifications properly on my device, but the requester device doesn't redirect or login
I see errors on the browser console about a request to a websocket even though I have websockets disabled

nevermind, figured it all out
this is pretty pretty pretty good

[brotaxt]

I'm using the latest bitwarden app for android and can't get the push notifications running. I did all the mentioned steps and read every comment here. My devices table doesn't show any push_uuid or push_token :(

sqlite> SELECT push_uuid, push_token FROM devices;
|
|

[pmalecka]

same here, happening on EU servers