If that is the only fix, then I'm not sure we should update this already.
Better wait for 2023.9.x

update to new web-vault release: web-v2023.9.0

Should I add a change to use the system theme by default? Or should we wait for bitwarden to ship this change?

Also I was wondering since bitwarden/clients#6309 was closed, if we should change the Authy recommendation ourselves?

I'll update my PR to 2023.9.1 tomorrow (when I have time to test the changes). If I do should I rename the patch file too? (The update doesn't require updating the patch file.)

I'll update my PR to 2023.9.1 tomorrow (when I have time to test the changes). If I do should I rename the patch file too? (The update doesn't require updating the patch file.)

I think that is wise. There are probably a lot of changes.
But it also needs to be tested good. Since they now force people to update the KDF. Do we need to do something on the server side too?

Same for the email generation annonaddy, we probably need to change that too.

@BlackDex Do you know how old an account would have to be to use a legacy encryption key? I.e. with what bitwarden_rs image I'd have to create a user account to test it?

And yeah, you're right. The API call (to https://app.addy.io/api/v1/aliases) fails because of CSP.

@stefan0xC The KDF iteration value was increased here: dani-garcia/vaultwarden#3163 and released in https://github.com/dani-garcia/vaultwarden/releases/tag/1.28.0, so, not that old when we changed this on the server-side at least.

Looking at the code from Bitwarden it looks like they updated the default for new accounts in v2023.2.0 (bitwarden/clients@2563fbd) which would make it v1.28 also because we release with that web-vault version.

@stefan0xC, i just did a quick test, and it seems to work just fine with Node18, so it's probably ok to update, also since Bitwarden stated it was an oversight.

For the KDF message we need to probably update the /api/config endpoint to provide the right key to show the message.
I think we should display this to increase the security display-kdf-iteration-warning: true https://vault.bitwarden.com/api/config

@BlackDex I've tested by creating a new user with the bitwardenrs/server:1.10 image and after updating to the current Vaultwarden main branch using the v2023.9.1 web-vault still works. I don't get the form that should be shown according to this PR bitwarden/clients#6195

I don't think that a low kdf iteration counts as having a legacy key. If you do have that you will get a warning once you have logged in but that has already been the case since web-v2023.7.0:

btw: This warning get's displayed even without display-kdf-iteration-warning: true (which does not do anything anymore, c.f. bitwarden/clients#5640).

After looking into it a bit I think that we can't have any users using legacy encryption (as defined here) because vaultwarden has always returned a key (c.f. the check here).

added dani-garcia/vaultwarden#3950 for the anonaddy rename.

The 2fa recovery link has been hardcoded to https://vault.bitwarden.com/#/recover-2fa in bitwarden/clients#5779

Should we change it back to the previous help link until bitwarden has fixed this for self-hosted installs?

edit: I think linking https://bitwarden.com/help/two-step-recovery-code/#use-your-recovery-code would be better (unless there's an easy way to fix this ourselves)

If that is a current bug then yes, since that will affect our users.

I've also reported it upstream: bitwarden/clients#6487

@BlackDex when will the release be?

Sorry, totally forgot this hehe :)

Also, this will not mean it will also be included right away in Vaultwarden.

Also, this will not mean it will also be included right away in Vaultwarden.

no problem, I will be able to build my build temporarily and wait for the official release.

The web-vault has been released already. So you can use the one from the releases page

The web-vault has been released already. So you can use the one from the releases page

I mean the VW assembly with the new version, created manually (locally docker .built) for myself so far :)
dani-garcia/vaultwarden#3989