Harden 2FA disable and website icon privacy

webapp/src/components/vault/WebsiteIcon.tsx

@@ -10,6 +10,7 @@ import {
 } from '@/lib/website-icon-cache';
 import { demoBrandIconUrl } from '@/lib/demo-brand-icons';
 import { getCurrentNetworkStatus, subscribeNetworkStatus } from '@/lib/network-status';
+import { areWebsiteIconsEnabled } from '@/lib/website-icon-settings';
 import { firstCipherUri, hostFromUri, websiteIconUrl } from '@/lib/website-utils';
 
 const ICON_LOAD_ROOT_MARGIN = '180px 0px';
@@ -22,7 +23,8 @@ interface WebsiteIconProps {
 
 export default function WebsiteIcon(props: WebsiteIconProps) {
   const host = useMemo(() => hostFromUri(firstCipherUri(props.cipher)), [props.cipher]);
-  const src = host ? websiteIconUrl(host) : '';
+  const iconsEnabled = areWebsiteIconsEnabled();
+  const src = iconsEnabled && host ? websiteIconUrl(host) : '';
   const nodeRef = useRef<HTMLSpanElement | null>(null);
   const [shouldLoad, setShouldLoad] = useState(() => (host ? getWebsiteIconStatus(host) === 'loaded' : true));
   const [status, setStatus] = useState(() => (host ? getWebsiteIconStatus(host) : 'idle'));
@@ -33,7 +35,7 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
   useEffect(() => subscribeNetworkStatus(setNetworkStatus), []);
 
   useEffect(() => {
-    if (!host) {
+    if (!host || !iconsEnabled) {
       setShouldLoad(true);
       setStatus('idle');
       setImageUrl('');
@@ -47,7 +49,7 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
       setStatus(next);
       setImageUrl(getWebsiteIconImageUrl(host));
     });
-  }, [host]);
+  }, [host, iconsEnabled]);
 
   useEffect(() => {
     if (!host || shouldLoad || status === 'loaded' || status === 'error') return;
@@ -81,10 +83,11 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
   useEffect(() => {
     if (SHOULD_LOAD_DEMO_BRAND_ICONS) return;
     if (demoIconUrl) return;
+    if (!iconsEnabled) return;
     if (networkStatus !== 'online') return;
     if (!host || !src || !shouldLoad || status !== 'idle') return;
     beginWebsiteIconLoad(host, src);
-  }, [demoIconUrl, host, networkStatus, src, shouldLoad, status]);
+  }, [demoIconUrl, host, iconsEnabled, networkStatus, src, shouldLoad, status]);
 
   if (demoIconUrl) {
     return (
@@ -100,7 +103,7 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
     );
   }
 
-  if (!host || status === 'error') {
+  if (!host || !iconsEnabled || status === 'error') {
     return <span className="list-icon-fallback">{props.fallback ?? <Globe size={18} />}</span>;
   }
 

webapp/src/lib/app-auth.ts

@@ -27,6 +27,7 @@ import {
   unlockOfflineVaultWithMasterKey,
 } from '@/lib/offline-auth';
 import { probeNodeWardenService } from '@/lib/network-status';
+import { setWebsiteIconsEnabled } from '@/lib/website-icon-settings';
 import type { AccountPasskeyPrfOption, AppPhase, Profile, SessionState, TokenSuccess, WebBootstrapResponse } from '@/lib/types';
 
 export interface PendingTotp {
@@ -51,6 +52,7 @@ export type JwtUnsafeReason = 'missing' | 'too_short';
 export interface BootstrapAppResult {
   defaultKdfIterations: number;
   registrationInviteRequired?: boolean;
+  websiteIconsEnabled: boolean;
   jwtWarning: { reason: JwtUnsafeReason; minLength: number } | null;
   session: SessionState | null;
   profile: Profile | null;
@@ -61,6 +63,7 @@ export interface BootstrapAppResult {
 export interface InitialAppBootstrapState {
   defaultKdfIterations: number;
   registrationInviteRequired?: boolean;
+  websiteIconsEnabled: boolean;
   jwtWarning: { reason: JwtUnsafeReason; minLength: number } | null;
   session: SessionState | null;
   phase: AppPhase;
@@ -229,10 +232,11 @@ function readWindowBootstrap(): WebBootstrapResponse {
   return raw && typeof raw === 'object' ? raw : {};
 }
 
-function normalizeBootstrapResponse(boot: WebBootstrapResponse): Pick<InitialAppBootstrapState, 'defaultKdfIterations' | 'registrationInviteRequired' | 'jwtWarning'> {
+function normalizeBootstrapResponse(boot: WebBootstrapResponse): Pick<InitialAppBootstrapState, 'defaultKdfIterations' | 'registrationInviteRequired' | 'websiteIconsEnabled' | 'jwtWarning'> {
   const defaultKdfIterations = Number(boot.defaultKdfIterations || 600000);
   const registrationInviteRequired =
     typeof boot.registrationInviteRequired === 'boolean' ? boot.registrationInviteRequired : undefined;
+  const websiteIconsEnabled = boot.websiteIconsEnabled === true;
   const jwtUnsafeReason = boot.jwtUnsafeReason || null;
   const jwtWarning = jwtUnsafeReason
     ? {
@@ -244,6 +248,7 @@ function normalizeBootstrapResponse(boot: WebBootstrapResponse): Pick<InitialApp
   return {
     defaultKdfIterations,
     registrationInviteRequired,
+    websiteIconsEnabled,
     jwtWarning,
   };
 }
@@ -304,7 +309,8 @@ function resolveUnauthenticatedPhase(registrationInviteRequired: boolean | undef
 }
 
 export function readInitialAppBootstrapState(): InitialAppBootstrapState {
-  const { defaultKdfIterations, registrationInviteRequired, jwtWarning } = normalizeBootstrapResponse(readWindowBootstrap());
+  const { defaultKdfIterations, registrationInviteRequired, websiteIconsEnabled, jwtWarning } = normalizeBootstrapResponse(readWindowBootstrap());
+  setWebsiteIconsEnabled(websiteIconsEnabled);
   const session = loadSession();
   const hasInviteCode = !!readInviteCodeFromUrl();
   const unauthenticatedPhase = hasInviteCode ? 'register' : 'login';
@@ -312,6 +318,7 @@ export function readInitialAppBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations,
     registrationInviteRequired,
+    websiteIconsEnabled,
     jwtWarning,
     session,
     phase: jwtWarning ? 'login' : session ? 'locked' : resolveUnauthenticatedPhase(registrationInviteRequired, unauthenticatedPhase),
@@ -323,12 +330,15 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
   const normalizedBoot = normalizeBootstrapResponse(remoteBoot);
   const defaultKdfIterations = normalizedBoot.defaultKdfIterations || initial.defaultKdfIterations;
   const registrationInviteRequired = normalizedBoot.registrationInviteRequired ?? initial.registrationInviteRequired;
+  const websiteIconsEnabled = normalizedBoot.websiteIconsEnabled;
+  setWebsiteIconsEnabled(websiteIconsEnabled);
   const jwtWarning = normalizedBoot.jwtWarning ?? initial.jwtWarning;
 
   if (jwtWarning) {
     return {
       defaultKdfIterations,
       registrationInviteRequired,
+      websiteIconsEnabled,
       jwtWarning,
       session: null,
       profile: null,
@@ -341,6 +351,7 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
     return {
       defaultKdfIterations,
       registrationInviteRequired,
+      websiteIconsEnabled,
       jwtWarning: null,
       session: null,
       profile: null,
@@ -353,6 +364,7 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
     return {
       defaultKdfIterations,
       registrationInviteRequired,
+      websiteIconsEnabled,
       jwtWarning: null,
       session: loaded,
       profile: cachedProfile,
@@ -364,6 +376,7 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
   return {
     defaultKdfIterations,
     registrationInviteRequired,
+    websiteIconsEnabled,
     jwtWarning: null,
     session: loaded,
     profile: null,

webapp/src/lib/demo.empty.ts

@@ -20,6 +20,7 @@ export function createDemoInitialBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations: 600000,
     registrationInviteRequired: true,
+    websiteIconsEnabled: false,
     jwtWarning: null,
     session: null,
     phase: 'login',

webapp/src/lib/demo.ts

@@ -790,6 +790,7 @@ export function createDemoInitialBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations: 600000,
     registrationInviteRequired: true,
+    websiteIconsEnabled: false,
     jwtWarning: null,
     session: null,
     phase: 'login',

webapp/src/lib/types.ts

@@ -412,6 +412,7 @@ export interface WebBootstrapResponse {
   jwtSecretMinLength?: number;
   registrationInviteRequired?: boolean;
   webAuthnAllowedOrigins?: string[];
+  websiteIconsEnabled?: boolean;
 }
 
 export interface YubiKeyOtpSettings {

webapp/src/lib/website-icon-settings.ts

@@ -0,0 +1,9 @@
+let websiteIconsEnabled = false;
+
+export function setWebsiteIconsEnabled(enabled: boolean): void {
+  websiteIconsEnabled = enabled;
+}
+
+export function areWebsiteIconsEnabled(): boolean {
+  return websiteIconsEnabled;
+}