Improve sso auth flow #395

New Issue

MrUnknownDE · 2026-04-05T21:07:52+02:00

MrUnknownDE commented

2026-04-05 21:07:52 +02:00

Originally created by @Timshel on 8/20/2025

This PR make multiple modifications to the authentication flow:

stop wrapping the returned values from the authorization (code or error) in a JWT token to pass through Bitwarden redirection. Instead, it stores them in database and use the state to find them again.
The length of the JWT Token might have been causing issue with the desktop client and Chrome on Windows.
stop using a memory cache to store the User information in case a 2FA flow is triggered, use the database that we were reading anyway.
Validate the Bitwarden clients PKCE code challenge to ensure that the client exchanging the code is the one which initiated the request (Either pass it to the provider or check it before calling it).

Documentation which could be added to the wiki:

On `SSO_PKCE`

When activated the Bitwarden Clients PKCE code challenge are passed to the provider.
If disabled PKCE validation is still done before exchanging the code.

*Originally created by @Timshel on 8/20/2025* This PR make multiple modifications to the authentication flow: - stop wrapping the returned values from the authorization (`code` or `error`) in a JWT token to pass through Bitwarden redirection. Instead, it stores them in database and use the `state` to find them again. The length of the JWT Token might have been causing issue with the desktop client and Chrome on Windows. - stop using a memory cache to store the User information in case a 2FA flow is triggered, use the database that we were reading anyway. - Validate the Bitwarden clients PKCE code challenge to ensure that the client exchanging the `code` is the one which initiated the request (Either pass it to the provider or check it before calling it). ------- Documentation which could be added to the wiki: ## Login Flow ### On `SSO_PKCE` When activated the Bitwarden Clients PKCE code challenge are passed to the provider. If disabled PKCE validation is still done before exchanging the code.

MrUnknownDE closed this issue

2026-04-05 21:07:52 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#395

Improve sso auth flow #395

Login Flow

On SSO_PKCE

On `SSO_PKCE`