Login flow asks for Yubikey OTP but its presence is ignored

[blacs30]

I have Yubikey OTP configured, the login flow asks for me to touch it.
By accident I entered some other text but then I noticed that the workflow had me logged in anyway.
I guess but haven't confirmed it that I am still logged in according to Bitwarden but the workflow, after a restart of my machine, asks me to login again.
Somewhere there is a bug. Either it really needs to log me in but then a wrong Yubikey OTP should prevent it or the workflow should detect that I am already logged in just need to unlock Bitwarden.

[ajrosen]

I just tried it and got "Two-step token is invalid. Try again." as expected.

The workflow checks with Bitwarden for its current state every time it's called, so it should never disagree about your login state. State is defined by whatever curl -s http://localhost:8087/status returns. If bw serve is not running/listening on port 8087, then you are are "unauthenticated" (logged out).

What I did find is it's possible to call the workflow a second time before the first "flow" is finished.

1. bw login
2. Enter Bitwarden username
3. Enter Master password
   a. bw login
4. Touch YubiKey
5. Get "You are logged in!" notification
   b. Enter Bitwarden username
   c. Enter Master password
   d. Enter garbage for YubiKey
   e. Get this malformed "You are logged in!" notification

{"success":true,"data":{"object":"template","template":{"serverUrl":null,"lastSync":"2024-08-03T14:43:20.912Z","userEmail":"user@example.com","userId":"00000000-0000-0000-0000-000000000000","status":"locked"}}}You are already logged in as user@example.com.

Could that have happened in your case?

[blacs30]

I missed the notification of your response. Will check more in detail and report back.

[blacs30]

I updated to the latest version.

{"success":true,"data":{"object":"template","template":{"serverUrl":null,"lastSync":"2024-08-03T14:43:20.912Z","userEmail":"user@example.com","userId":"00000000-0000-0000-0000-000000000000","status":"locked"}}}You are already logged in as user@example.com.

Could that have happened in your case?

Yes that is what happens to me after a reboot of the system.