E-Mail Account Verification and Organisation Invites fails

[ASeehawer]

E-Mail Account Verification and Organization Invites fails

I am using Vaultvarden as Docker-Compose installation and are on the latest version:

docker pull vaultwarden/server:latest
latest: Pulling from vaultwarden/server
Digest: sha256:71668d20d4208d70919cf8cb3caf3071d41ed4b7d95afe71125ccad8408b040d
Status: Image is up to date for vaultwarden/server:latest
docker.io/vaultwarden/server:latest

The Links I get send bye email to verify my email-address: i get this:

[2024-08-15 15:43:58.725][request][INFO] GET /api/organizations/undefined/policies/token?token=undefined&email=undefine
[2024-08-15 15:43:58.725][response][INFO] (list_policies_token) GET /api/organizations/<org_id>/policies/token?<token> => 200 OK

By using the link to join an organization, I get this:

[2024-08-15 15:41:24.041][request][INFO] GET /api/organizations/undefined/policies/token?token=undefined&email=undefine
[2024-08-15 15:41:24.041][response][INFO] (list_policies_token) GET /api/organizations/<org_id>/policies/token?<token> => 200 OK

Deployment environment

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.32.0
• Web-vault version: v2024.6.2b
• OS/Arch: linux/x86_64
• Running within a container: true (Base: Debian)
• Environment settings overridden: true
• Uses a reverse proxy: true
• IP Header check: true (X-Real-IP)
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• Browser/Server Time Check: true
• Server/NTP Time Check: true
• Domain Configuration Check: true
• HTTPS Check: true
• Database type: SQLite
• Database version: 3.46.0
• Clients used:
• Reverse proxy and version:
• Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden: DOMAIN, SENDS_ALLOWED, SIGNUPS_ALLOWED, SIGNUPS_VERIFY, SIGNUPS_VERIFY_RESEND_TIME, SIGNUPS_VERIFY_RESEND_LIMIT, INVITATIONS_ALLOWED, EMERGENCY_ACCESS_ALLOWED, SHOW_PASSWORD_HINT, ADMIN_TOKEN, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_USERNAME, SMTP_PASSWORD

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "cid:",
  "admin_ratelimit_max_burst": 10,
  "admin_ratelimit_seconds": 60,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*****************",
  "domain_origin": "*****://*****************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "fido2-vault-credentials",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "IT-Hafen",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": "/data/vaultwarden.log",
  "log_level": "debug",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "**********************,***********************,*******************",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 6000000,
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": true,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 5,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "*****************",
  "smtp_from_name": "Nogle",
  "smtp_host": "**************************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "*******************",
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

• vaultwarden version:

• Install method: Docker-Compose

• Clients used: Web

• Reverse proxy and version: Traefik 3.1.2

[BlackDex]

Have you tried this via a different browser or private windows to see if that solves it?

[ASeehawer]

Hi,
i tried:

• different Browsers:
  • Safari, Chrome, Firefox (all up to date)
• different Mail Programs:
  • Web Browser
  • Thunderbird
• to copy the Link and paste it in to the Browser

This phenomenon comes first with the update to version 1.32

[BlackDex]

Strange, i have tried it yesterday during fixing manager roles. And it worked fine for me.

We need a bit more logs. Like the browser developer console, parts of the url you received. Maybe even your reverse proxy logs etc...

[ASeehawer]

This is the log Part, wen I click the link (and copy paste the link) in the email "join Organization Now"

[2024-08-15 18:38:21.370][tokio_tungstenite::compat][TRACE] WouldBlock
[2024-08-15 18:38:23.424][tracing::span][TRACE] parse_headers;
[2024-08-15 18:38:23.424][tracing::span::active][TRACE] -> parse_headers;
[2024-08-15 18:38:23.424][tracing::span::active][TRACE] <- parse_headers;
[2024-08-15 18:38:23.424][tracing::span][TRACE] -- parse_headers;
[2024-08-15 18:38:23.424][request][INFO] GET /api/organizations/undefined/policies/token?token=undefined&email=undefine
[2024-08-15 18:38:23.424][response][INFO] (list_policies_token) GET /api/organizations/<org_id>/policies/token?<token> => 200 OK
[2024-08-15 18:38:23.425][tracing::span][TRACE] encode_headers;
[2024-08-15 18:38:23.425][tracing::span::active][TRACE] -> encode_headers;
[2024-08-15 18:38:23.425][tracing::span::active][TRACE] <- encode_headers;
[2024-08-15 18:38:23.425][tracing::span][TRACE] -- encode_headers;

The link from the email:

https://nogle.it-hafen.de/#/accept-organization/?organizationId=9872802d-482e-49be-a573-7f1fa8d1a171&organizationUserId=fa6999d4-3e3b-4435-b1f3-308bd5f23f13&email=jassch%40imb%2Esh&organizationName=10067%2DIMB&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJuYmYiOjE3MjM3NDY5NDIsImV4cCI6MTcyNDE3ODk0MiwiaXNzIjoiaHR0cHM6Ly9ub2dsZS5pdC1oYWZlbi5kZXxpbnZpdGUiLCJzdWIiOiJmOGJkZDM4Mi01ZDgwLTRlMTktYjM1ZS0wZmZjNmZhZjAzZTUiLCJlbWFpbCI6Imphc3NjaEBpbWIuc2giLCJvcmdfaWQiOiI5ODcyODAyZC00ODJlLTQ5YmUtYTU3My03ZjFmYThkMWExNzEiLCJ1c2VyX29yZ19pZCI6ImZhNjk5OWQ0LTNlM2ItNDQzNS1iMWYzLTMwOGJkNWYyM2YxMyIsImludml0ZWRfYnlfZW1haWwiOiJhLnNlZWhhd2VyQGl0LWhhZmVuLmRlIn0.bG2vc9xFdq82FprHkMULN0qr7e-si2uN48LL1u7669I8vgIf9iBN-DxFd4_Bj5syi179gEHhDciI1Ql41Vbvw33tH6ipOGWYQwXVMJZ5G8kWfpEksjJdrjtY92dsDLwkiYbHx_N3eH6gShEYE9RCkj22XhQxGU8LVQJjKuJwxztNnXhI4eccKqqJ2-btTfzB1b1Uwo1cb2mfCh3zrmz3YY6eF5S5yDITaUDOgvKksAYYpFtklV-TbbofvsOdLu5ScqSHfnSDlvZRt8ctx8wk2CHb4aKV2ql9hGIbR4LzPoghbycwD1NOchQcXX5KJAT0gq0K0a9KykDnCU9oSAjnwg

The network trace from the Browser "F12" after calling the link:

GET
	https://nogle.it-hafen.de/api/organizations/undefined/policies/token?token=undefined&email=undefined&organizationUserId=undefined

Browser Console Log:
console-export-2024-8-15_20-55-47.txt

20:54:22.998 Gewechselt zu https://nogle.it-hafen.de/#/accept-organization/?organizationId=9872802d-482e-49be-a573-7f1fa8d1a171&organizationUserId=fa6999d4-3e3b-4435-b1f3-308bd5f23f13&email=jassch%40imb%2Esh&organizationName=10067%2DIMB&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJuYmYiOjE3MjM3NDY5NDIsImV4cCI6MTcyNDE3ODk0MiwiaXNzIjoiaHR0cHM6Ly9ub2dsZS5pdC1oYWZlbi5kZXxpbnZpdGUiLCJzdWIiOiJmOGJkZDM4Mi01ZDgwLTRlMTktYjM1ZS0wZmZjNmZhZjAzZTUiLCJlbWFpbCI6Imphc3NjaEBpbWIuc2giLCJvcmdfaWQiOiI5ODcyODAyZC00ODJlLTQ5YmUtYTU3My03ZjFmYThkMWExNzEiLCJ1c2VyX29yZ19pZCI6ImZhNjk5OWQ0LTNlM2ItNDQzNS1iMWYzLTMwOGJkNWYyM2YxMyIsImludml0ZWRfYnlfZW1haWwiOiJhLnNlZWhhd2VyQGl0LWhhZmVuLmRlIn0.bG2vc9xFdq82FprHkMULN0qr7e-si2uN48LL1u7669I8vgIf9iBN-DxFd4_Bj5syi179gEHhDciI1Ql41Vbvw33tH6ipOGWYQwXVMJZ5G8kWfpEksjJdrjtY92dsDLwkiYbHx_N3eH6gShEYE9RCkj22XhQxGU8LVQJjKuJwxztNnXhI4eccKqqJ2-btTfzB1b1Uwo1cb2mfCh3zrmz3YY6eF5S5yDITaUDOgvKksAYYpFtklV-TbbofvsOdLu5ScqSHfnSDlvZRt8ctx8wk2CHb4aKV2ql9hGIbR4LzPoghbycwD1NOchQcXX5KJAT0gq0K0a9KykDnCU9oSAjnwg
20:54:23.030 GET
https://nogle.it-hafen.de/#/accept-organization/?organizationId=9872802d-482e-49be-a573-7f1fa8d1a171&organizationUserId=fa6999d4-3e3b-4435-b1f3-308bd5f23f13&email=jassch@imb.sh&organizationName=10067-IMB&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJuYmYiOjE3MjM3NDY5NDIsImV4cCI6MTcyNDE3ODk0MiwiaXNzIjoiaHR0cHM6Ly9ub2dsZS5pdC1oYWZlbi5kZXxpbnZpdGUiLCJzdWIiOiJmOGJkZDM4Mi01ZDgwLTRlMTktYjM1ZS0wZmZjNmZhZjAzZTUiLCJlbWFpbCI6Imphc3NjaEBpbWIuc2giLCJvcmdfaWQiOiI5ODcyODAyZC00ODJlLTQ5YmUtYTU3My03ZjFmYThkMWExNzEiLCJ1c2VyX29yZ19pZCI6ImZhNjk5OWQ0LTNlM2ItNDQzNS1iMWYzLTMwOGJkNWYyM2YxMyIsImludml0ZWRfYnlfZW1haWwiOiJhLnNlZWhhd2VyQGl0LWhhZmVuLmRlIn0.bG2vc9xFdq82FprHkMULN0qr7e-si2uN48LL1u7669I8vgIf9iBN-DxFd4_Bj5syi179gEHhDciI1Ql41Vbvw33tH6ipOGWYQwXVMJZ5G8kWfpEksjJdrjtY92dsDLwkiYbHx_N3eH6gShEYE9RCkj22XhQxGU8LVQJjKuJwxztNnXhI4eccKqqJ2-btTfzB1b1Uwo1cb2mfCh3zrmz3YY6eF5S5yDITaUDOgvKksAYYpFtklV-TbbofvsOdLu5ScqSHfnSDlvZRt8ctx8wk2CHb4aKV2ql9hGIbR4LzPoghbycwD1NOchQcXX5KJAT0gq0K0a9KykDnCU9oSAjnwg
[HTTP/2 200  0ms]

20:54:23.110 GET
https://nogle.it-hafen.de/app/polyfills.575bcaf3121104d1c55d.js
[HTTP/2 200  0ms]

20:54:23.110 GET
https://nogle.it-hafen.de/app/main.73ccce5ce537ae0d8937.css
[HTTP/2 200  0ms]

20:54:23.110 GET
https://nogle.it-hafen.de/theme_head.4cb181fc19f2a308ba73.js

20:54:23.111 GET
https://nogle.it-hafen.de/app/vendor.0d3c724de0f2ab138712.js
[HTTP/2 200  0ms]

20:54:23.112 GET
https://nogle.it-hafen.de/app/main.c938814c26533b40a106.js
[HTTP/2 200  0ms]

20:54:23.157 GET
https://nogle.it-hafen.de/fonts/Open_Sans-normal-400.8465030b62273715c99d.woff
[HTTP/2 200  0ms]

20:54:23.158 GET
https://nogle.it-hafen.de/fonts/bwi-font.b934f3d3f42f13942a9d.ttf
[HTTP/2 200  0ms]

20:54:23.200 GET
https://nogle.it-hafen.de/images/logo-dark@2x.png

20:54:23.278 XHRGET
https://nogle.it-hafen.de/locales/de/messages.json?cache=wag6kj
[HTTP/2 200  0ms]

20:54:23.283 GET
https://nogle.it-hafen.de/images/apple-touch-icon.png
[HTTP/2 200  0ms]

20:54:23.284 GET
https://nogle.it-hafen.de/images/favicon-16x16.png
[HTTP/2 200  0ms]

20:54:23.318 XHRGET
https://nogle.it-hafen.de/locales/en/messages.json?cache=wag6kj
[HTTP/2 200  0ms]

20:54:23.360 Unhandled error in angular TypeError: e is null
    34437/Jn/this.orgName$< accept-organization.service.ts:50
    r map.ts:58
    _next OperatorSubscriber.ts:70
    next Subscriber.ts:75
    _subscribe BehaviorSubject.ts:23
    _trySubscribe Observable.ts:244
    _trySubscribe Subject.ts:113
    u Observable.ts:234
    r errorContext.ts:29
    subscribe Observable.ts:220
    r map.ts:54
    r lift.ts:24
    u Observable.ts:226
    r errorContext.ts:29
    subscribe Observable.ts:220
    createSubscription async_pipe.ts:29
    rn untracked.ts:22
    createSubscription async_pipe.ts:29
    _subscribe async_pipe.ts:140
    transform async_pipe.ts:124
    Xp pipe.ts:169
    Vr accept-organization.component.html:21
    rc shared.ts:277
    Gc change_detection.ts:140
    Kc change_detection.ts:321
    Vc change_detection.ts:257
    Gc change_detection.ts:167
    Kc change_detection.ts:321
    Yc change_detection.ts:293
    $c change_detection.ts:335
    Gc change_detection.ts:197
    Kc change_detection.ts:321
    Vc change_detection.ts:257
    Gc change_detection.ts:167
    Kc change_detection.ts:321
    Yc change_detection.ts:293
    $c change_detection.ts:335
    Gc change_detection.ts:197
    Kc change_detection.ts:321
    Vc change_detection.ts:257
    Gc change_detection.ts:167
    Kc change_detection.ts:321
    Yc change_detection.ts:293
    $c change_detection.ts:335
    Gc change_detection.ts:197
    Hc change_detection.ts:39
    detectChanges view_ref.ts:321
    tick application_ref.ts:1052
    next application_ref.ts:1234
    invoke zone.umd.js:411
    onInvoke ng_zone.ts:443
    invoke zone.umd.js:410
    run zone.umd.js:165
    run ng_zone.ts:218
    next application_ref.ts:1233
    next Subscriber.ts:161
    _next Subscriber.ts:119
    next Subscriber.ts:75
    next Subject.ts:68
    r errorContext.ts:29
    next Subject.ts:61
    emit event_emitter.ts:114
    Sl ng_zone.ts:357
    onHasTask ng_zone.ts:461
    hasTask zone.umd.js:465
    _updateTaskCount zone.umd.js:486
    _updateTaskCount zone.umd.js:309
    runTask zone.umd.js:227
    w zone.umd.js:634
    promise callback*m zone.umd.js:610
    b zone.umd.js:621
    scheduleTask zone.umd.js:435
    onScheduleTask zone.umd.js:322
    scheduleTask zone.umd.js:425
    scheduleTask zone.umd.js:253
    scheduleMicroTask zone.umd.js:273
    D zone.umd.js:1304
    P zone.umd.js:1241
    A zone.umd.js:1157
    O zone.umd.js:1173
    promise callback*18981/n/</B/t.prototype.then/< zone.umd.js:1565
    t zone.umd.js:1339
    then zone.umd.js:1564
    P zone.umd.js:1208
    A zone.umd.js:1157
    O zone.umd.js:1173
    l main.c938814c26533b40a106.js:11
    t zone.umd.js:1339
    l main.c938814c26533b40a106.js:11
    s main.c938814c26533b40a106.js:11
    invoke zone.umd.js:411
    onInvoke ng_zone.ts:443
    invoke zone.umd.js:410
    run zone.umd.js:165
    D zone.umd.js:1314
    invokeTask zone.umd.js:445
    onInvokeTask ng_zone.ts:428
    invokeTask zone.umd.js:444
    runTask zone.umd.js:210
    w zone.umd.js:634
    promise callback*m zone.umd.js:610
    b zone.umd.js:621
    scheduleTask zone.umd.js:435
    onScheduleTask zone.umd.js:322
    scheduleTask zone.umd.js:425
    scheduleTask zone.umd.js:253
    scheduleMicroTask zone.umd.js:273
    D zone.umd.js:1304
    P zone.umd.js:1241
    A zone.umd.js:1157
console-log.service.ts:51:16
20:54:23.365 GET
https://nogle.it-hafen.de/fonts/Open_Sans-normal-600.7f2861051b34a8ecd9f2.woff
[HTTP/2 200  0ms]

20:54:23.395 XHRGET
https://nogle.it-hafen.de/api/organizations/undefined/policies/token?token=undefined&email=undefined&organizationUserId=undefined
[HTTP/2 200  21ms]

[stefan0xC]

If you replace the & with & from the link it seems to work. Not sure how they get added in your case (because the invitation mail doesn't seem to have them when I look at the source of the received mail), but this is probably a client side bug which we can't do anything about.

[BlackDex]

You can see here Vaultwarden uses an &

vaultwarden/src/static/templates/email/send_org_invite.html.hbs

Line 12 in 9e26014

<a href="{{url}}/#/accept-organization/?organizationId={{org_id}}&organizationUserId={{org_user_id}}&email={{email}}&organizationName={{org_name_encoded}}&token={{token}}"

The only thing i can think of is that you modified the templates to translate them maybe? And that those templates have a wrong format.

[ASeehawer]

I haven't changed anything in the templates or the translation.

[BlackDex]

Then it must be something else on your system, like extensions, the mail server you use or something like that.
You could test what happens if you start a local mailserver and send the mails to that and see what happens.

You can start a local mail server by running this:

docker run -d --rm --name maildev -p 1080:1080 -p 1025:1025 maildev/maildev

And then configure Vaultwarden to use that as a mail server.
I do not know how you run your Vaultwarden exactly, so not sure what you need to configure in SMTP_HOST, but that should be reachable by the Vaultwarden container at least.

SMTP_HOST=127.0.0.1
SMTP_FROM=vaultwarden@domain.tld
SMTP_SECURITY=off
SMTP_PORT=1025

You can then access the web-interface of the local mailserver by going to http://127.0.0.1:1080.

[BlackDex]

You may also send me an invite if you want, then i can check the body and see if something is wrong there.
black.dex AT gmail DOT com

[BlackDex]

Going to close this as not re-producable and move it to a discussion.
It looks like either templates are overwritten, or something in-between Vaultwarden and the final receiver is modifying the HTML Body of the mail. Or maybe even some global application, extension or Anti-Virus or Firewall application.

I have done several more tests, and I am unable to get it converted to &amp unless i manually modify it in the template.