saret/vaultwarden
1
0 Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.wiki.git synced 2026-11-05 01:18:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Document the v2 encryption feature flags

Browse Source
This commit is contained in:
Daniel García committed 2026-11-02 18:19:08 +01:00
1 parent 22b306bdde
commit 57acc1a926
2 files changed
+8 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.env.template
+6
View File
@@ -410,6 +410,12 @@
## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0) ## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers. ## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers.
## Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet. ## Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
## - "pm-27278-v2-password-registration": Register new accounts with v2 encryption. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0, Android >= 2026.4.1, iOS >= 2026.5.1)
## - "enable-account-encryption-v2-jit-password-registration": Give SSO users who set their master password on their first login v2 encryption. (Web >= 2026.1.1, Desktop/Browser/CLI >= 2026.1.0, Android >= 2026.4.1, iOS >= 2026.6.0)
## - "force-upgrade-v2-encryption": Upgrade every v1 account to v2 encryption the next time it's unlocked in a web, desktop, browser or CLI client. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0)
## These three flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2025.11.0 or newer and send their version, which rules out some older and third-party clients.
## - "pm-30144-sdk-key-rotation": Only for clients up to 2026.10.0 (Desktop up to 2026.10.1): together with "force-upgrade-v2-encryption", a manual key rotation also upgrades a v1 account to v2.
## - "pm-31050-no-logout-key-upgrade-rotation": Only for clients 2026.6.0 to 2026.10.0 (Desktop up to 2026.10.1): sync instead of logging out after the upgrade to v2. Newer clients always do.
# EXPERIMENTAL_CLIENT_FEATURE_FLAGS= # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
## Require new device emails. When a user logs in an email is required to be sent. ## Require new device emails. When a user logs in an email is required to be sent.
src/api/core/accounts.rs
+2 -1
View File
@@ -1775,7 +1775,8 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
// Prevent logging out the client where the user requested this endpoint from. // Prevent logging out the client where the user requested this endpoint from.
// If you do logout the user it will causes issues at the client side. // If you do logout the user it will causes issues at the client side.
// Adding the device uuid will prevent this. // Adding the device uuid will prevent this.
// On an upgrade, the reason lets clients with `pm-31050-no-logout-key-upgrade-rotation` sync instead // On an upgrade, the reason lets clients sync instead: always from 2026.10.1 (Desktop 2026.10.2), before only
// with `pm-31050-no-logout-key-upgrade-rotation`
let reason = is_upgrade.then_some(LogOutReason::KeyRotation); let reason = is_upgrade.then_some(LogOutReason::KeyRotation);
nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await; nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;