# Can't login if two factor authentication is enabled

**URL:** <https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152>\
**Category:** Help\
**Created:** [June 14, 2020, 7:15pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152 "2020-06-14T19:15:50Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![TimoK](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/timok/32/100_2.png) [@TimoK](https://vaultwarden.discourse.group/u/TimoK)\
**Post date:** [June 14, 2020, 7:15pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/1 "2020-06-14T19:15:50Z")

</div>

Hello,  
I recently installed Bitwarden\_RS. If a user has two factor authentication enabled, the login fails from the Android-App and from the Web-Vault. _It is not possible to enter a token._ The server-time is correct. If the user only has enabled e-mail verification, an e-mail with a code is send.

**My environment:**  
Bitwarden\_RS version: 1.15.0-52ed8e4d  
Bitwarden Web version: 2.14.0  
Install method: Docker image  
Reverse proxy: Apache/2.4.38 (Debian Buster)

**Relevant logs:**

> [2020-06-14 20:04:48][request][INFO] POST /api/accounts/prelogin  
> [2020-06-14 20:04:48][response][INFO] POST /api/accounts/prelogin (prelogin) =\> 200 OK  
> [2020-06-14 20:04:48][request][INFO] POST /identity/connect/token  
> [2020-06-14 20:04:48][error][ERROR] 2FA token not provided  
> [2020-06-14 20:04:48][response][INFO] POST /identity/connect/token (login) =\> 400 Bad Request

**docker-compose.yml:**  
[Pastebin](https://pastebin.com/raw/vwRz4dAw)

Thank you very much!

---

<div class="post-metadata">

**Author:** ![jjlin](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jjlin](https://vaultwarden.discourse.group/u/jjlin)\
**Post date:** [June 14, 2020, 7:39pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/2 "2020-06-14T19:39:19Z")

</div>

So what exactly happens when the login fails? Screenshots would be helpful.

Your logs look normal. 2FA login is supposed to return 400 initially, after which the client is supposed to prompt the user for the 2FA token and retry the login.

---

<div class="post-metadata">

**Author:** ![TimoK](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/timok/32/100_2.png) [@TimoK](https://vaultwarden.discourse.group/u/TimoK)\
**Post date:** [June 14, 2020, 7:47pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/3 "2020-06-14T19:47:07Z")

</div>

![image](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/1X/95de0efd7e31281610561744a5b404f804189248.png)  
The message “an unknown error has occurred” is shown.  
There is simply no option to enter a token. The same happens with different browsers/devices and in the app.  
Thanks

---

<div class="post-metadata">

**Author:** ![jjlin](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jjlin](https://vaultwarden.discourse.group/u/jjlin)\
**Post date:** [June 14, 2020, 7:57pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/4 "2020-06-14T19:57:42Z")

</div>

Open the browser dev tools (pressing F12 usually works), then try logging in via the web vault and see if that provides any further insight into what’s going wrong.

---

<div class="post-metadata">

**Author:** ![TimoK](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/timok/32/100_2.png) [@TimoK](https://vaultwarden.discourse.group/u/TimoK)\
**Post date:** [June 14, 2020, 8:08pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/5 "2020-06-14T20:08:58Z")

</div>

Thanks for your response.  
I already tried that. I am only getting the HTTP 400 error. The console is not showing anything other.  
Greetings

---

<div class="post-metadata">

**Author:** ![jjlin](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jjlin](https://vaultwarden.discourse.group/u/jjlin)\
**Post date:** [June 14, 2020, 8:28pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/6 "2020-06-14T20:28:47Z")

</div>

There should be response data returned along with the 400 error, e.g.

```auto
{"TwoFactorProviders":[0],"TwoFactorProviders2":{"0":null},"error":"invalid_grant","error_description":"Two factor required."}

```

Is that what you get? If so, it seems like it would be a client side issue, since it’s up to the client to prompt for the 2FA token.

---

<div class="post-metadata">

**Author:** ![TimoK](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/timok/32/100_2.png) [@TimoK](https://vaultwarden.discourse.group/u/TimoK)\
**Post date:** [June 14, 2020, 8:51pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/7 "2020-06-14T20:51:49Z")

</div>

The 404 error does not return anything:

```
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
</body></html>
```

---

<div class="post-metadata">

**Author:** ![jjlin](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jjlin](https://vaultwarden.discourse.group/u/jjlin)\
**Post date:** [June 14, 2020, 10:32pm UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/8 "2020-06-14T22:32:22Z")

</div>

Well, that would explain why your apps aren’t prompting for 2FA. You’ll need to share more details of your config then, like probably the reverse proxy, and anything else that might be unusual.

---

<div class="post-metadata">

**Author:** ![TimoK](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/timok/32/100_2.png) [@TimoK](https://vaultwarden.discourse.group/u/TimoK)\
**Post date:** [June 15, 2020, 6:29am UTC](https://vaultwarden.discourse.group/t/cant-login-if-two-factor-authentication-is-enabled/152/9 "2020-06-15T06:29:17Z")

</div>

Hi, thanks for your response.  
I found the error 😀.  
My Reverse Proxy is a Apache2 Webserver, with PHP-FPM. The option **ProxyErrorOverride on** was enabled for the vHost of the password manager and caused this issue.  
So it was an problem with the reverse proxy.  
Thanks for helping.