bitwarden/docs

Bitwarden application and API documentation.

---

Bitwarden Client Applications

This repository houses all Bitwarden client applications except the Mobile application.

Please refer to the Clients section of the Contributing Documentation for build instructions, recommended tooling, code style tips, and lots of other great information to get you started.

Related projects:

• bitwarden/server: The core infrastructure backend (API, database, Docker, etc).
• bitwarden/mobile: The mobile app vault (iOS and Android).
• bitwarden/directory-connector: A tool for syncing a directory (AD, LDAP, Azure, G Suite, Okta) to an organization.

We're Hiring!

Interested in contributing in a big way? Consider joining our team! We're hiring for many positions. Please take a look at our Careers page to see what opportunities are currently open as well as what it's like to work at Bitwarden.

Contribute

Code contributions are welcome! Please commit any pull requests against the main branch. Learn more about how to contribute by reading the Contributing Guidelines. Check out the Contributing Documentation for how to get started with your first contribution.

Security audits and feedback are welcome. Please open an issue or email us privately if the report is sensitive in nature. You can read our security policy in the SECURITY.md file.

docs's Issues

RNG documentation

Hello,

Could it be possible to add to the documentation the sources used for your RandomByte function on every support (mobile app, cli, browser extension, ...).

As some websites permit to know when a user registered (you know like "member since 01/04/2018 17:04"), if the bitwarden password generator uses a clock based PRNG, an adversary could crack the password of the users who relied on this password generator.

I see that you use some CSPRNG library like WinRTCrypto. But I think it's important to easily permit (through the documentation) people to know how secure are the PRNG involved.
Also, when a CSPRNG library has vulnerabilities discovered, it could be easier to know if bitwarden is affected or not.

Thanks

Missing Basic authentication in REST authentication documentation

The documentation states, that 4 parameters need to be passed to get the Bearer Token: grant_type, scope, client_id, client_secret. When providing those 4 parameters to the API in a self-hosted setup, the server responds only with {"error":"invalid_client"}.

When I was inspecting the request that is made in the API-Documentation (/api/docs) I saw, that Basic-Authentication is used and only the two parameters grant_type and scope are passed as parameter.

$ curl -X POST "http://localhost:8080/identity/connect/token" -H 'Content-Type: application/x-www-form-urlencoded' -d "grant_type=client_credentials&scope=api.organization&client_id=organization.my-org-id&secret=sup3rs3cr3t"
{"error":"invalid_client"}
$
$ curl -X POST "http://localhost:8080/identity/connect/token" -H 'Content-Type: application/x-www-form-urlencoded' -d "grant_type=client_credentials&scope=api.organization" --user "organization:my-org-id:sup3rs3cr3t"
{"access_token":"<access-token>","expires_in":3600,"token_type":"Bearer","scope":"api.organization"}

I couldn't find where the source for the API documentation is stored. Could you please update the documentation to the correct API call (via Basic Authentication).