Bitwarden-go - A Bitwarden-compatible server written in Golang

I have a docker container for Bitwarden-go, the binary running inside is based on my pull request VictorNine/bitwarden-go/pull/8 that is started this way.

I also have a docker container for Bitwarden Vault which is told to point to http://localhost:8000 as there is were Bitwarden-go listens requests.

Bitwarden-go can response to requests perfectly fine:

jorge@morpho ~ % wget 0.0.0.0:8000/api/accounts/register          
--2018-01-05 04:13:34--  http://0.0.0.0:8000/api/accounts/register
Connecting to 0.0.0.0:8000... connected.
HTTP request sent, awaiting response... 400 Bad Request
2018-01-05 04:13:34 ERROR 400: Bad Request.

However, Bitwarden Vault tells me that "Errors have occurred. · An unexpected error has occurred." and I cannot register my account (or login, I put the credentials I cannot register and try to login but bitwarden vault displays the exact error message).

I don't have any output from the bitwarden-go binary indicating an error.

What am I doing wrong?

I add this change for the reason that I would like to set the location of the database somewhere else than ./, this is useful for binaries running inside a Docker container, we can save the database inside a Docker volume.

I also changed the SQL statement for creating the tables to create them only if they do not exist. This allow running the option -init more than once without triggering errors or breaking something in the database.

I was not able to connect to the bitwarden-go server with the WebVault and found that "Device-Type" and "Content-Type" headers had to be allowed in the CORS options to make it work.

Hello,

To be curious, which feature do you cover with your api version ? Do you cover :

• the web vault
• The import tool
• the collection/team
• folders relationship

I've tried to understand your code, but i'm not familiar with Go.

One more question :

• Do you check each parameters sent to avoid SQL injection ?
• How do you manager user session ? Cookie ?

If i try and import my fairly large KeePass XML file, bitwarden-go crashes:

$ /home/bitwarden/go/bin/bitwarden-go -disableRegistration -location /home/bitwarden/go/bin/ 2019/04/07 15:10:43 Starting server on :8000 2019/04/07 15:11:15 dave@xxxx is trying to import data 2019/04/07 15:11:15 json: cannot unmarshal array into Go struct field newCipher.fields of type string

If I try and import a smaller set (a folder containing one or two entries), this is reported as successful by bitwarden-web but no entries appear. bitwarden-go reports:

$ /home/bitwarden/go/bin/bitwarden-go -disableRegistration -location /home/bitwarden/go/bin/ 2019/04/07 15:11:35 Starting server on :8000 2019/04/07 15:11:39 dave@xxxx is trying to import data

In the chrome inspector, I can see a successful POST to api/ciphers/import and then a GET to api/accounts/revision-date (which fails - 404)

Adding a single item through bitwarden-web, or one of the mobile apps works fine.

With the latest vault release (v1.23.0), account login, 2FA, and folders work but existing items are missing.

Registering a new user on a fresh DB works.

Trying to add a new item triggers an error message on vault:

Server stdout reports: 2018/03/13 16:13:27 [email protected] is trying to add data

Other bitwarden clients are working fine (e.g. Android app, Firefox extension).

Not sure if this is related to the upcoming API changes?

Just thought you should know that there are some breaking changes coming to cipher API models.

1. Cipher.Login.Uri on the request and response models is being deprecated in favor of Cipher.Login.Uris, an array of { "Uri": string, "Match": enum }
2. The cipher response model is being updated to better match the request model. Namely:
   • Data prop is being deprecated.
   • Adding: Name, Notes, and Fields to the root object.
   • Adding: Login, Card, Identity, and SecureNote to the root object (their prop values were part of the dynamic Data property in the past).

Our API will handle these changes in a backwards compatible way for a few iterations since outdated client apps will still be expecting the old models for some time.

These changes are already in the Core API project and refactoring is being done in all client apps over the next few days.

This moves the configuration for server settings to be read from a more user-friendly "config.yaml" in the root directory of the repo.

Also, moving main.go from cmd/ to cmd/bitwarden-go/ will make go build and go install use a default name of "bitwarden-go", instead of "cmd".

I believe I have successfully built and installed bitwarden-go. Running bitwarden-go -init doesn't terminate, which wasn't what I expected according to README.md, but that's fine.

Trying to connect to server, via port 8000, right from the server or from another host, gets me a 404 error.

Killing bitwarden-go -init with ctrl-c and restarting it without the -init gets the same result.

I may just have misinterpreted what the server provides. Am I completely wrong in expecting some sort of web interface to be hosted by bitwarden-go? Or should I be pointing another client at it?

root@pi_fhem:~/go# go get github.com/VictorNine/bitwarden-go package github.com/VictorNine/bitwarden-go: no buildable Go source files in /root/go/src/github.com/VictorNine/bitwarden-go

Anyone else with the following issue? The server crashes when /api/accounts/revision-date is called by clients:

2018-06-01 03:14:28 | stdout | 2018/06/01 03:14:28 Starting server on :8000
2018-06-01 03:14:25 | stdout | 2018/06/01 03:14:25 Get http://172.18.0.2:4001/api/accounts/revision-date: dial tcp 172.18.0.2:4001: connect: connection refused
2018-06-01 03:09:27 | stdout | 2018/06/01 03:09:27 Starting server on :8000
2018-06-01 03:09:24 | stdout | 2018/06/01 03:09:24 Get http://172.18.0.2:4001/api/accounts/revision-date: dial tcp 172.18.0.2:4001: connect: connection refused
2018-06-01 03:04:26 | stdout | 2018/06/01 03:04:26 Starting server on :8000
2018-06-01 03:04:23 | stdout | 2018/06/01 03:04:23 Get http://172.18.0.2:4001/api/accounts/revision-date: dial tcp 172.18.0.2:4001: connect: connection refused
2018-06-01 02:59:27 | stdout | 2018/06/01 02:59:27 Starting server on :8000
2018-06-01 02:59:23 | stdout | 2018/06/01 02:59:23 Get http://172.18.0.2:4001/api/accounts/revision-date: dial tcp 172.18.0.2:4001: connect: connection refused
2018-06-01 02:54:26 | stdout | 2018/06/01 02:54:26 Starting server on :8000
2018-06-01 02:54:23 | stdout | 2018/06/01 02:54:23 Get http://172.18.0.2:4001/api/accounts/revision-date: dial tcp 172.18.0.2:4001: connect: connection refused
2018-06-01 02:49:25 | stdout | 2018/06/01 02:49:25 Starting server on :8000
2018-06-01 02:49:22 | stdout | 2018/06/01 02:49:22 Get http://172.18.0.2:4001/api/accounts/revision-date: dial tcp 172.18.0.2:4001: connect: connection refused
2018-06-01 02:44:25 | stdout | 2018/06/01 02:44:25 Starting server on :8000

Windows 10 just used the exact same server, login and password for browser extension and it works fine. Desktop app tells me there is there something I am missing. I also checked if anyone had the same issue is closed tickets. Is there a version I need to download specifically? Trying to get fingerprint reader in browser extension to work. Do I need to docker-compose up -d my container and update? please assist.

P.S love the app its awesome thank you for all your hard work. I donated today.

I've got bitwarden-go installed in an lxc container and have it listening on 0.0.0.0:8000 but when I point my browser to 192.168.0.37:8000 it just says '404 page not found'

This should close #27 . I have tested with bitwarden-web, the chrome plugin, windows desktop app and Android app - all seem to function correctly following this PR.

We frequently get people using these third party servers that contact official support channels for help with problems they are having with it. Lots of times we go back and forth trying to figure out what the problem they are having is only to find out later they are using a third-party server (which they originally fail to mention) and we can't help. This is a drain on resources for the official Bitwarden product. I am not sure what the solution is, but could you brainstorm ideas on how to better communicate to users that they shouldn't do this? I suppose a simple start would be to put a notice in the README or something but I am not sure that is going to solve the problem completely.

Thanks.

I downloaded the binary from the releases page, and ran it with -init and got:

$ bitwarden-go-linux-arm -init
2019/01/08 22:55:27 SQL error with 
...
Binary was compiled with 'CGO_ENABLED=0', go-sqlite3 requires cgo to work. This is a stub