Passbolt Browser Extension Integration

PVY

Brief Summary
Passbolt.com is On Prem/Sefl Hosted Password Manager with Team Features. Its very popular in Europe, D-A-CH, IT, FR.
Current Extension does not work, if taken from Chrome Store or Firefox addons, even if you emulate FF/GC Browser or play with custom agents around. Passbolt.com Team stated in May, they will hook up here.

Details:
IT Guys in Central Europe does not push their Credentials to Cloud. Passbolt stand in terms of security above Bitwarden etc, so It would be nice, to get that working for Orion / Orion+

Image/Video:
<Copy/paste or drag and drop to upload images or videos (up to 20MB)>

Vlad

PVY Did you test in RC?

PVY

Yes i did, both, from Google Chrome, as from Firefox Store.
The Extension is blacked. Under Extension Management, Permission Management ist there.

If you like, I can make you an account on our one, but requires a VM since we access it over a P2P VPN Solution. But I can provide that. Need to know OS of VM, to prep some keys for the VPN Client.

PVY

I am also open to fund that, if necessary...

Vlad

PVY It is up to you, support helps. Also full steps to reproduce if any accounts are needed.

PVY

I will organize it.

PVY

Feedback is following: They release for Safari Webkit an Extension. They checked the issue with Orion and Chrome Variant, stated, its an Orio Issue, which they can not support due lack of ressources, but assuming, that the Safari Extension shall work, since Orion is built on top of latest Webkit..

Vlad

PVY Safari Extensions are propriatery and work only with Safari.

PVY

Yop. Going to prep an account for Devs to Test. Comes by mail tomorrow.

PVY

Vlad Awesome progress and Thanks for enabling this. Unfortunate, the Login still doesn't work, I have made a short repeatable vidoe and exported the json recording, where I see only graphic issues, but maybe it helps, otherwise I am happy to expose it shortly and issue an account to test.

pbpvyswiss-recording.txt

3MB

lviardcretat

How come this ticket has been tagged as fixed?
I have the same issue as PVY:

The Passbolt Chrome extension simply does not work; a pop-up opens explaining that the browser is not supported.
The Firefox extension loads at login and repeatedly redisplays the login screen.
Has this really been fixed, or is the problem not with Orion but with Passbolt? It was explained earlier in this thread that Passbolt couldn't do anything on their end.

tmthn

Hi everyone,

I ran into the same problem with Passbolt in Orion and spent some time debugging it with the extension's background console. The good news: I think I found the actual cause. It's not the extension or the Passbolt server. Orion doesn't store cookies set in responses to requests made by the extension, so the login session is never established.

Here are the details, in case it helps the Orion team fix this (ai assisted):

Cookies set in responses to extension requests are not stored (breaks Passbolt login)

Summary:
When a web extension makes a request to a host covered by its host_permissions, Orion treats the request as cross-site and does not store cookies from the Set-Cookie response header. Chrome and Firefox store these cookies. This makes the Passbolt password manager extension unusable in Orion, because its login session is established via such a request.

Steps to reproduce:

Install the Passbolt browser extension (Chrome Web Store or Firefox Add-ons version, both affected).
Complete account recovery against a self-hosted Passbolt instance (https://passbolt.example.com).
Open the instance in a tab. The extension's login iframe is shown correctly.
Enter the passphrase and log in.

Expected behavior:
The session cookie from the login response is stored, and the user is logged in, as in Chrome and Firefox.

Actual behavior:
The page redirects from / to /auth/login?redirect=%2F and asks for the email address again. The session is never established.

Technical findings (from the extension's background console):

The login response contains a valid Set-Cookie header.
The cookie is not stored: subsequent requests from the extension are sent without a Cookie header and return 401 (/auth/is-authenticated.json, /users/<id>.json).
Extension requests to the host carry "Sec-Fetch-Site: cross-site". In Chrome, requests from an extension to hosts in its host_permissions are treated as first-party.
Disabling cross-site tracking prevention / third-party cookie blocking, globally and per-site for the host, makes no difference.

Request excerpt:
GET /auth/is-authenticated.json
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
(no Cookie header)
-> 401

Suggested fix:
Treat extension requests to hosts in host_permissions as first-party for cookie storage, consistent with Chrome and Firefox.

Orion, OS version; hardware type:
Orion 1.1.3 (152), WebKit 625.1.8, MacBook Pro 26.6.2 (Build 25G83)
Passbolt extension version: 5.17.1