chore: release v1.7.3

- Add password and authType fields to Send type
- Show lock icon in send list for password-protected sends
- Display masked dots in password field when editing a send that has a password set
- Add Remove button to clear existing password

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "nodewarden",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nodewarden",
-      "version": "1.7.2",
+      "version": "1.7.3",
       "license": "LGPL-3.0",
       "dependencies": {
         "@noble/hashes": "^2.2.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodewarden",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Minimal Bitwarden-compatible server running on Cloudflare Workers",
   "author": "shuaiplus",
   "license": "LGPL-3.0",

shared/app-version.ts

@@ -1 +1 @@
-export const APP_VERSION = '1.7.2';
+export const APP_VERSION = '1.7.3';

src/handlers/accounts.ts

@@ -1161,16 +1161,8 @@ export async function handleDisableTwoFactorProvider(request: Request, env: Env,
     return errorResponse('Two-factor provider is not supported by this server.', 400);
   }
 
-  const key = normalizeTotpSecret(readBodyString(body, ['key', 'Key']));
-  const userVerificationToken = readBodyString(body, ['userVerificationToken', 'UserVerificationToken']);
   const secret = readBodyString(body, ['masterPasswordHash', 'MasterPasswordHash', 'otp', 'OTP', 'secret', 'Secret']);
-  let verified = false;
-  if (key && userVerificationToken) {
-    verified = await verifyTotpUserVerificationToken(env, user, key, userVerificationToken);
-  }
-  if (!verified) {
-    verified = await verifyUserSecret(auth, user, secret);
-  }
+  const verified = await verifyUserSecret(auth, user, secret);
   if (!verified) return errorResponse('User verification failed.', 400);
 
   if (type === TWO_FACTOR_PROVIDER_AUTHENTICATOR) {

src/handlers/attachments.ts

@@ -439,17 +439,16 @@ export async function handlePublicDownloadAttachment(
   }
 
   const path = getAttachmentObjectKey(cipherId, attachmentId);
-  const object = await getBlobObject(env, path);
-
-  if (!object) {
-    return errorResponse('Attachment file not found', 404);
-  }
-
   const firstUse = await storage.consumeAttachmentDownloadToken(claims.jti, claims.exp);
   if (!firstUse) {
     return errorResponse('Invalid or expired token', 401);
   }
 
+  const object = await getBlobObject(env, path);
+  if (!object) {
+    return errorResponse('Attachment file not found', 404);
+  }
+
   return new Response(object.body, {
     headers: {
       'Content-Type': sanitizeDownloadContentType(object.contentType),

src/handlers/auth-requests.ts

@@ -96,8 +96,8 @@ function toAuthRequestResponse(request: Request, authRequest: AuthRequestRecord,
     RequestCountryName: authRequest.requestCountryName,
     key: authRequest.key,
     Key: authRequest.key,
-    masterPasswordHash: authRequest.masterPasswordHash,
-    MasterPasswordHash: authRequest.masterPasswordHash,
+    masterPasswordHash: null,
+    MasterPasswordHash: null,
     creationDate: authRequest.creationDate,
     CreationDate: authRequest.creationDate,
     responseDate: authRequest.responseDate,
@@ -349,7 +349,6 @@ export async function handleUpdateAuthRequest(request: Request, env: Env, userId
 
   const approved = Boolean(readBodyValue(body, ['requestApproved', 'RequestApproved']));
   const key = normalizeText(readBodyValue(body, ['key', 'Key']), 20000);
-  const masterPasswordHash = normalizeText(readBodyValue(body, ['masterPasswordHash', 'MasterPasswordHash']), 20000) || null;
   const responseDeviceIdentifier =
     normalizeText(readBodyValue(body, ['deviceIdentifier', 'DeviceIdentifier']), 128) ||
     readActingDeviceIdentifier(request) ||
@@ -366,7 +365,7 @@ export async function handleUpdateAuthRequest(request: Request, env: Env, userId
     approved,
     responseDeviceIdentifier,
     key,
-    masterPasswordHash,
+    masterPasswordHash: null,
   });
   if (!updated) return errorResponse('Auth request has already been answered.', 409);
   const updatedRequest = await storage.getAuthRequestByIdForUser(id, userId);

src/handlers/backup.ts

@@ -1062,12 +1062,21 @@ export async function handleDownloadAdminRemoteBackup(request: Request, env: Env
 export async function handleInspectAdminRemoteBackup(request: Request, env: Env, actorUser: User): Promise<Response> {
   if (!isAdmin(actorUser)) return errorResponse('Forbidden', 403);
 
+  let body: { destinationId?: string; path?: string; masterPasswordHash?: string };
+  try {
+    body = await request.json<{ destinationId?: string; path?: string; masterPasswordHash?: string }>();
+  } catch {
+    return errorResponse('Remote backup integrity payload is invalid', 400);
+  }
+
+  const verificationError = await requireBackupUserVerification(actorUser, String(body.masterPasswordHash || ''), env);
+  if (verificationError) return verificationError;
+
   const storage = new StorageService(env.DB);
   try {
     const settings = await loadBackupSettings(storage, env, 'UTC');
-    const url = new URL(request.url);
-    const path = ensureRemoteRestoreCandidate(url.searchParams.get('path') || '');
-    const destination = requireBackupDestination(settings, url.searchParams.get('destinationId') || null);
+    const path = ensureRemoteRestoreCandidate(String(body.path || ''));
+    const destination = requireBackupDestination(settings, body.destinationId || null);
     const remoteFile = await downloadRemoteBackupFile(destination, path);
     const integrity = await inspectBackupArchiveFileNameChecksum(remoteFile.bytes, remoteFile.fileName || path);
     return jsonResponse({
@@ -1239,7 +1248,28 @@ export async function handleDownloadAdminBackupAttachment(request: Request, env:
 
   try {
     const url = new URL(request.url);
-    const blobName = ensureBackupBlobName(url.searchParams.get('blobName') || '');
+    let input: { blobName?: unknown; masterPasswordHash?: unknown } = {};
+    if (request.method === 'POST') {
+      try {
+        input = await request.json<{ blobName?: unknown; masterPasswordHash?: unknown }>();
+      } catch {
+        return errorResponse('Backup attachment download payload is invalid', 400);
+      }
+    } else {
+      input = {
+        blobName: url.searchParams.get('blobName') || '',
+        masterPasswordHash: url.searchParams.get('masterPasswordHash') || '',
+      };
+    }
+
+    const verificationError = await requireBackupUserVerification(
+      actorUser,
+      String(input.masterPasswordHash || ''),
+      env
+    );
+    if (verificationError) return verificationError;
+
+    const blobName = ensureBackupBlobName(String(input.blobName || ''));
     const object = await getBlobObject(env, blobName);
     if (!object) {
       return errorResponse('Backup attachment blob not found', 404);

src/handlers/sends-public.ts

@@ -300,17 +300,17 @@ export async function handleDownloadSendFile(
     return errorResponse(SEND_INACCESSIBLE_MSG, 404);
   }
 
+  const firstUse = await storage.consumeAttachmentDownloadToken(`send:${claims.jti}`, claims.exp);
+  if (!firstUse) {
+    return errorResponse('Invalid or expired token', 401);
+  }
+
   const object = await getBlobObject(env, getSendFileObjectKey(sendId, fileId));
   if (!object) {
     return errorResponse('Send file not found', 404);
   }
   const fileName = typeof data.fileName === 'string' ? data.fileName : fileId;
 
-  const firstUse = await storage.consumeAttachmentDownloadToken(`send:${claims.jti}`, claims.exp);
-  if (!firstUse) {
-    return errorResponse('Invalid or expired token', 401);
-  }
-
   return new Response(object.body, {
     headers: {
       'Content-Type': sanitizeDownloadContentType(object.contentType),

src/index.ts

@@ -89,7 +89,7 @@ export default {
     const normalizedRequest = normalizeRequestUrl(request);
     const assetResponse = await maybeServeAsset(normalizedRequest, env);
     if (assetResponse) {
-      return applyCors(normalizedRequest, assetResponse);
+      return applyCors(normalizedRequest, assetResponse, env);
     }
 
     await ensureDatabaseInitialized(env);
@@ -107,11 +107,11 @@ export default {
         },
         500
       );
-      return applyCors(normalizedRequest, resp);
+      return applyCors(normalizedRequest, resp, env);
     }
 
     const resp = await handleRequest(normalizedRequest, env);
-    return applyCors(normalizedRequest, resp);
+    return applyCors(normalizedRequest, resp, env);
   },
 
   async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext): Promise<void> {

src/router-admin-backup.ts

@@ -26,7 +26,7 @@ export async function handleAdminBackupRoute(
     return handleAdminExportBackup(request, env, actorUser);
   }
 
-  if (path === '/api/admin/backup/blob' && method === 'GET') {
+  if (path === '/api/admin/backup/blob' && (method === 'GET' || method === 'POST')) {
     return handleDownloadAdminBackupAttachment(request, env, actorUser);
   }
 
@@ -54,7 +54,7 @@ export async function handleAdminBackupRoute(
     return handleDownloadAdminRemoteBackup(request, env, actorUser);
   }
 
-  if (path === '/api/admin/backup/remote/integrity' && method === 'GET') {
+  if (path === '/api/admin/backup/remote/integrity' && method === 'POST') {
     return handleInspectAdminRemoteBackup(request, env, actorUser);
   }
 

src/router-public.ts

@@ -35,6 +35,7 @@ import { isSafeWebsiteIconContentType } from './utils/content-type';
 import { jsonResponse, unsupportedResponse } from './utils/response';
 import { StorageService } from './services/storage';
 import type { Env } from './types';
+import { getConfiguredWebAuthnAllowedOrigins } from './utils/origins';
 
 type PublicRateLimiter = (category?: string, maxRequests?: number) => Promise<Response | null>;
 type JwtUnsafeReason = 'missing' | 'too_short' | null;
@@ -44,6 +45,12 @@ export interface WebBootstrapResponse {
   jwtUnsafeReason: JwtUnsafeReason;
   jwtSecretMinLength: number;
   registrationInviteRequired: boolean;
+  webAuthnAllowedOrigins: string[];
+  websiteIconsEnabled: boolean;
+}
+
+function isWebsiteIconProxyEnabled(env: Env): boolean {
+  return true;
 }
 
 function isSameOriginWriteRequest(request: Request): boolean {
@@ -255,7 +262,11 @@ function iconResponse(body: BodyInit | null, contentType: string | null): Respon
   });
 }
 
-async function handleWebsiteIcon(host: string, fallbackMode: 'default' | 'not-found' = 'default'): Promise<Response> {
+async function handleWebsiteIcon(env: Env, host: string, fallbackMode: 'default' | 'not-found' = 'default'): Promise<Response> {
+  if (!isWebsiteIconProxyEnabled(env)) {
+    return fallbackMode === 'not-found' ? handleMissingWebsiteIcon() : handleNwFavicon();
+  }
+
   const normalizedHost = normalizeIconHost(host);
   if (!normalizedHost) return fallbackMode === 'not-found' ? handleMissingWebsiteIcon() : handleNwFavicon();
 
@@ -322,6 +333,8 @@ export async function buildWebBootstrapResponse(env: Env): Promise<WebBootstrapR
     jwtUnsafeReason,
     jwtSecretMinLength: LIMITS.auth.jwtSecretMinLength,
     registrationInviteRequired: userCount > 0,
+    webAuthnAllowedOrigins: getConfiguredWebAuthnAllowedOrigins(env),
+    websiteIconsEnabled: isWebsiteIconProxyEnabled(env),
   };
 }
 
@@ -372,7 +385,7 @@ export async function handlePublicRoute(
     const blocked = await enforcePublicRateLimit('public-icon', LIMITS.rateLimit.publicIconRequestsPerMinute);
     if (blocked) return blocked;
     const fallbackMode = new URL(request.url).searchParams.get('fallback') === '404' ? 'not-found' : 'default';
-    return handleWebsiteIcon(iconMatch[1], fallbackMode);
+    return handleWebsiteIcon(env, iconMatch[1], fallbackMode);
   }
 
   const publicAttachmentMatch = path.match(/^\/api\/attachments\/([a-f0-9-]+)\/([a-f0-9-]+)$/i);

src/router.ts

@@ -148,7 +148,7 @@ export async function handleRequest(request: Request, env: Env): Promise<Respons
   }
 
   if (method === 'OPTIONS') {
-    return handleCors(request);
+    return handleCors(request, env);
   }
 
   try {

src/services/backup-archive.ts

@@ -442,9 +442,10 @@ export function validateBackupPayloadContents(
   for (const row of accountPasskeyRows) {
     const id = String(row.id || '').trim();
     const userId = String(row.user_id || '').trim();
+    const purpose = row.purpose == null ? 'login' : String(row.purpose || '').trim();
     const credentialId = String(row.credential_id || '').trim();
     const publicKey = String(row.public_key || '').trim();
-    if (!id || !userIds.has(userId) || !credentialId || !publicKey) {
+    if (!id || !userIds.has(userId) || !credentialId || !publicKey || (purpose !== 'login' && purpose !== 'twoFactor')) {
       throw new Error('Backup archive contains an invalid account passkey row');
     }
     if (accountPasskeyIds.has(id)) throw new Error(`Backup archive contains duplicate account passkey id: ${id}`);
@@ -493,7 +494,7 @@ export async function buildBackupArchive(
     queryRows(env.DB, 'SELECT id, user_id, name, created_at, updated_at FROM folders ORDER BY created_at ASC'),
     queryRows(env.DB, 'SELECT id, user_id, type, folder_id, name, notes, favorite, data, reprompt, key, created_at, updated_at, archived_at, deleted_at FROM ciphers ORDER BY created_at ASC'),
     queryRows(env.DB, 'SELECT id, cipher_id, file_name, size, size_name, key FROM attachments ORDER BY cipher_id ASC, id ASC'),
-    queryRows(env.DB, 'SELECT id, user_id, name, public_key, credential_id, counter, type, aa_guid, transports, encrypted_user_key, encrypted_public_key, encrypted_private_key, supports_prf, created_at, updated_at FROM webauthn_credentials ORDER BY created_at ASC'),
+    queryRows(env.DB, 'SELECT id, user_id, purpose, name, public_key, credential_id, counter, type, aa_guid, transports, encrypted_user_key, encrypted_public_key, encrypted_private_key, supports_prf, created_at, updated_at FROM webauthn_credentials ORDER BY created_at ASC'),
     queryRows(env.DB, 'SELECT token, user_id, device_identifier, expires_at FROM trusted_two_factor_device_tokens WHERE expires_at >= ? ORDER BY user_id ASC, device_identifier ASC, expires_at DESC', date.getTime()),
   ]);
   const exportedConfigRows = sanitizeConfigRowsForExport(configRows);

src/services/backup-config.ts

@@ -68,6 +68,114 @@ function normalizePath(value: unknown): string {
   return asTrimmedString(value).replace(/\\/g, '/').replace(/^\/+|\/+$/g, '');
 }
 
+function normalizeHostnameForPolicy(hostname: string): string {
+  return hostname.trim().toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+}
+
+function parseIpv4Address(hostname: string): number[] | null {
+  const parts = hostname.split('.');
+  if (parts.length !== 4) return null;
+  const octets = parts.map((part) => {
+    if (!/^\d{1,3}$/.test(part)) return -1;
+    const value = Number(part);
+    return Number.isInteger(value) && value >= 0 && value <= 255 ? value : -1;
+  });
+  return octets.every((value) => value >= 0) ? octets : null;
+}
+
+function isBlockedIpv4Address(octets: number[]): boolean {
+  const [a, b, c] = octets;
+  return (
+    a === 0 ||
+    a === 10 ||
+    a === 127 ||
+    (a === 100 && b >= 64 && b <= 127) ||
+    (a === 169 && b === 254) ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && (b === 0 || b === 168)) ||
+    (a === 198 && (b === 18 || b === 19 || (b === 51 && c === 100))) ||
+    (a === 203 && b === 0 && c === 113) ||
+    a >= 224
+  );
+}
+
+function isBlockedIpv6Address(hostname: string): boolean {
+  if (!hostname.includes(':')) return false;
+  const normalized = hostname.toLowerCase();
+  const mappedIpv4 = normalized.match(/::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
+  if (mappedIpv4) {
+    const octets = parseIpv4Address(mappedIpv4[1]);
+    return !octets || isBlockedIpv4Address(octets);
+  }
+  const firstHextetText = normalized.split(':').find((part) => part.length > 0) || '0';
+  const firstHextet = Number.parseInt(firstHextetText, 16);
+  if (!Number.isFinite(firstHextet)) return true;
+  return (
+    firstHextet === 0 ||
+    (firstHextet & 0xfe00) === 0xfc00 ||
+    (firstHextet & 0xffc0) === 0xfe80 ||
+    (firstHextet & 0xff00) === 0xff00 ||
+    normalized.startsWith('2001:db8:')
+  );
+}
+
+function assertBackupEndpointHostAllowed(hostname: string, label: string): void {
+  const normalized = normalizeHostnameForPolicy(hostname);
+  if (!normalized) throw new Error(`${label} host is required`);
+  if (
+    normalized === 'localhost' ||
+    normalized === 'localhost.localdomain' ||
+    normalized.endsWith('.localhost.localdomain') ||
+    normalized.endsWith('.localhost') ||
+    normalized.endsWith('.local') ||
+    normalized.endsWith('.home.arpa') ||
+    normalized.endsWith('.internal') ||
+    normalized.endsWith('.lan') ||
+    normalized === 'metadata.google.internal' ||
+    normalized === 'localtest.me' ||
+    normalized.endsWith('.localtest.me') ||
+    normalized === 'lvh.me' ||
+    normalized.endsWith('.lvh.me') ||
+    normalized === 'vcap.me' ||
+    normalized.endsWith('.vcap.me') ||
+    normalized === 'nip.io' ||
+    normalized.endsWith('.nip.io') ||
+    normalized === 'sslip.io' ||
+    normalized.endsWith('.sslip.io') ||
+    normalized === 'xip.io' ||
+    normalized.endsWith('.xip.io')
+  ) {
+    throw new Error(`${label} host is not allowed`);
+  }
+  const ipv4 = parseIpv4Address(normalized);
+  if (ipv4 && isBlockedIpv4Address(ipv4)) {
+    throw new Error(`${label} host is not allowed`);
+  }
+  if (isBlockedIpv6Address(normalized)) {
+    throw new Error(`${label} host is not allowed`);
+  }
+}
+
+export function normalizeBackupEndpointUrl(value: string, label: string): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`${label} must be a valid URL`);
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`${label} must start with http:// or https://`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error(`${label} must not include credentials`);
+  }
+  if (parsed.search || parsed.hash) {
+    throw new Error(`${label} must not include query or fragment`);
+  }
+  assertBackupEndpointHostAllowed(parsed.hostname, label);
+  return parsed.toString().replace(/\/+$/, '');
+}
+
 function assertValidTimeZone(timezone: string): string {
   try {
     new Intl.DateTimeFormat('en-US', { timeZone: timezone }).format(new Date());
@@ -123,7 +231,7 @@ function normalizeS3Destination(value: unknown, allowIncomplete = false): S3Back
 
   if (!allowIncomplete || endpoint) {
     if (!endpoint) throw new Error('S3 endpoint is required');
-    if (!/^https?:\/\//i.test(endpoint)) throw new Error('S3 endpoint must start with http:// or https://');
+    normalizeBackupEndpointUrl(endpoint, 'S3 endpoint');
   }
   if (!allowIncomplete || bucket) {
     if (!bucket) throw new Error('S3 bucket is required');
@@ -136,7 +244,7 @@ function normalizeS3Destination(value: unknown, allowIncomplete = false): S3Back
   }
 
   return {
-    endpoint: endpoint ? endpoint.replace(/\/+$/, '') : '',
+    endpoint: endpoint ? normalizeBackupEndpointUrl(endpoint, 'S3 endpoint') : '',
     bucket,
     addressingStyle,
     region,
@@ -155,7 +263,7 @@ function normalizeWebDavDestination(value: unknown, allowIncomplete = false): We
 
   if (!allowIncomplete || baseUrl) {
     if (!baseUrl) throw new Error('WebDAV server URL is required');
-    if (!/^https?:\/\//i.test(baseUrl)) throw new Error('WebDAV server URL must start with http:// or https://');
+    normalizeBackupEndpointUrl(baseUrl, 'WebDAV server URL');
   }
   if (!allowIncomplete || username) {
     if (!username) throw new Error('WebDAV username is required');
@@ -165,7 +273,7 @@ function normalizeWebDavDestination(value: unknown, allowIncomplete = false): We
   }
 
   return {
-    baseUrl: baseUrl ? baseUrl.replace(/\/+$/, '') : '',
+    baseUrl: baseUrl ? normalizeBackupEndpointUrl(baseUrl, 'WebDAV server URL') : '',
     username,
     password,
     remotePath,

src/services/backup-import.ts

@@ -254,6 +254,10 @@ function cloneRows(rows: SqlRow[]): SqlRow[] {
   return rows.map((row) => ({ ...row }));
 }
 
+function normalizeAccountPasskeyPurpose(value: unknown): 'login' | 'twoFactor' {
+  return value == null ? 'login' : String(value).trim() === 'twoFactor' ? 'twoFactor' : 'login';
+}
+
 function upsertConfigRow(rows: SqlRow[], key: string, value: string): SqlRow[] {
   let replaced = false;
   const nextRows = rows.map((row) => {
@@ -303,7 +307,10 @@ async function importPreparedBackupRows(db: D1Database, payload: BackupPayload['
     domain_settings: cloneRows(payload.domain_settings || []),
     user_revisions: cloneRows(payload.user_revisions || []),
     trusted_two_factor_device_tokens: cloneRows(payload.trusted_two_factor_device_tokens || []),
-    webauthn_credentials: cloneRows(payload.webauthn_credentials || []),
+    webauthn_credentials: cloneRows(payload.webauthn_credentials || []).map((row) => ({
+      ...row,
+      purpose: normalizeAccountPasskeyPurpose(row.purpose),
+    })),
     folders: cloneRows(payload.folders || []),
     ciphers: cloneRows(payload.ciphers || []).map((row) => ({
       ...row,
@@ -668,7 +675,7 @@ async function importBackupRows(db: D1Database, payload: BackupPayload['db'], us
     buildInsertStatements(
       db,
       tableName('webauthn_credentials'),
-      ['id', 'user_id', 'name', 'public_key', 'credential_id', 'counter', 'type', 'aa_guid', 'transports', 'encrypted_user_key', 'encrypted_public_key', 'encrypted_private_key', 'supports_prf', 'created_at', 'updated_at'],
+      ['id', 'user_id', 'purpose', 'name', 'public_key', 'credential_id', 'counter', 'type', 'aa_guid', 'transports', 'encrypted_user_key', 'encrypted_public_key', 'encrypted_private_key', 'supports_prf', 'created_at', 'updated_at'],
       payload.webauthn_credentials || []
     )
   );

src/services/backup-uploader.ts

@@ -3,6 +3,7 @@ import {
   BackupDestinationType,
   S3BackupDestination,
   WebDavBackupDestination,
+  normalizeBackupEndpointUrl,
 } from './backup-config';
 
 export interface BackupUploadResult {
@@ -215,7 +216,7 @@ function ensureDestinationConfigReady(destination: BackupDestinationRecord): voi
   if (destination.type === 'webdav') {
     const config = destination.destination as WebDavBackupDestination;
     if (!String(config.baseUrl || '').trim()) throw new Error('WebDAV server URL is required');
-    if (!/^https?:\/\//i.test(String(config.baseUrl || '').trim())) throw new Error('WebDAV server URL must start with http:// or https://');
+    normalizeBackupEndpointUrl(String(config.baseUrl || '').trim(), 'WebDAV server URL');
     if (!String(config.username || '').trim()) throw new Error('WebDAV username is required');
     if (!String(config.password || '')) throw new Error('WebDAV password is required');
     return;
@@ -223,7 +224,7 @@ function ensureDestinationConfigReady(destination: BackupDestinationRecord): voi
   if (destination.type === 's3') {
     const config = destination.destination as S3BackupDestination;
     if (!String(config.endpoint || '').trim()) throw new Error('S3 endpoint is required');
-    if (!/^https?:\/\//i.test(String(config.endpoint || '').trim())) throw new Error('S3 endpoint must start with http:// or https://');
+    normalizeBackupEndpointUrl(String(config.endpoint || '').trim(), 'S3 endpoint');
     if (!String(config.bucket || '').trim()) throw new Error('S3 bucket is required');
     if (!String(config.accessKeyId || '').trim()) throw new Error('S3 access key is required');
     if (!String(config.secretAccessKey || '')) throw new Error('S3 secret key is required');
@@ -252,7 +253,7 @@ async function ensureWebDavDirectory(baseUrl: string, directoryPath: string, aut
         Authorization: authHeader,
       },
     });
-    if ([200, 201, 204, 301, 302, 405].includes(response.status)) continue;
+    if ([200, 201, 204, 405].includes(response.status)) continue;
     throw new Error(`WebDAV directory creation failed: ${response.status}`);
   }
 }
@@ -275,7 +276,7 @@ async function ensureWebDavDirectoryCached(
         Authorization: authHeader,
       },
     });
-    if ([200, 201, 204, 301, 302, 405].includes(response.status)) {
+    if ([200, 201, 204, 405].includes(response.status)) {
       ensuredDirectories.add(current);
       continue;
     }
@@ -518,7 +519,7 @@ async function signedS3Request(
     config.region || 'auto'
   );
 
-  return fetch(url.toString(), {
+  return fetch(url, {
     method,
     headers: {
       Authorization: authorization,

src/utils/account-passkeys.ts

@@ -12,6 +12,7 @@ import type {
   WebAuthnPrfDecryptionOption,
 } from '../types';
 import { base64UrlToBytes, bytesToBase64Url } from './passkey';
+import { getConfiguredWebAuthnAllowedOrigins } from './origins';
 
 const ACCOUNT_PASSKEY_TOKEN_TYPE = 'nodewarden.account-passkey.challenge.v1';
 const ACCOUNT_PASSKEY_TOKEN_TTL_MS = 17 * 60 * 1000;
@@ -159,22 +160,8 @@ export function getAccountPasskeyRpConfig(request: Request, env: Env): { rpId: s
   const configuredRpId = String(env.WEBAUTHN_RP_ID || '').trim();
   const rpId = configuredRpId || url.hostname;
   const rpName = String(env.WEBAUTHN_RP_NAME || '').trim() || DEFAULT_RP_NAME;
-  const configuredOrigins = String(env.WEBAUTHN_ALLOWED_ORIGINS || '')
-    .split(',')
-    .map((origin) => origin.trim())
-    .filter(Boolean);
+  const configuredOrigins = getConfiguredWebAuthnAllowedOrigins(env);
   const origins = new Set<string>([url.origin, ...configuredOrigins]);
-  const requestOrigin = request.headers.get('Origin');
-  if (
-    requestOrigin
-    && (
-      requestOrigin.startsWith('chrome-extension://')
-      || requestOrigin.startsWith('moz-extension://')
-      || requestOrigin.startsWith('safari-web-extension://')
-    )
-  ) {
-    origins.add(requestOrigin);
-  }
   return { rpId, rpName, origins: Array.from(origins) };
 }
 

src/utils/origins.ts

@@ -0,0 +1,42 @@
+import type { Env } from '../types';
+
+export function normalizeOrigin(value: unknown): string | null {
+  const raw = String(value || '').trim();
+  if (!raw) return null;
+
+  try {
+    const url = new URL(raw);
+    if (!url.protocol || !url.host) return null;
+    return `${url.protocol}//${url.host}`;
+  } catch {
+    return null;
+  }
+}
+
+export function isBrowserExtensionOrigin(origin: unknown): boolean {
+  const normalized = normalizeOrigin(origin);
+  return !!normalized && (
+    normalized.startsWith('chrome-extension://')
+    || normalized.startsWith('moz-extension://')
+    || normalized.startsWith('safari-web-extension://')
+  );
+}
+
+export function getConfiguredWebAuthnAllowedOrigins(
+  env: Pick<Env, 'WEBAUTHN_ALLOWED_ORIGINS'>
+): string[] {
+  const seen = new Set<string>();
+  for (const item of String(env.WEBAUTHN_ALLOWED_ORIGINS || '').split(',')) {
+    const origin = normalizeOrigin(item);
+    if (origin) seen.add(origin);
+  }
+  return Array.from(seen);
+}
+
+export function isConfiguredWebAuthnAllowedOrigin(
+  env: Pick<Env, 'WEBAUTHN_ALLOWED_ORIGINS'>,
+  origin: unknown
+): boolean {
+  const normalized = normalizeOrigin(origin);
+  return !!normalized && getConfiguredWebAuthnAllowedOrigins(env).includes(normalized);
+}

src/utils/response.ts

@@ -1,4 +1,10 @@
 import { LIMITS } from '../config/limits';
+import type { Env } from '../types';
+import {
+  isBrowserExtensionOrigin,
+  isConfiguredWebAuthnAllowedOrigin,
+  normalizeOrigin,
+} from './origins';
 
 const CORS_METHODS = 'GET, POST, PUT, DELETE, PATCH, OPTIONS';
 const DEFAULT_CORS_HEADERS = [
@@ -18,14 +24,6 @@ const DEFAULT_CORS_HEADERS = [
   'X-NodeWarden-Web-Session',
 ];
 
-function isExtensionOrigin(origin: string): boolean {
-  return (
-    origin.startsWith('chrome-extension://')
-    || origin.startsWith('moz-extension://')
-    || origin.startsWith('safari-web-extension://')
-  );
-}
-
 function isWildcardCorsPath(path: string): boolean {
   return (
     path.startsWith('/icons/')
@@ -38,18 +36,19 @@ function isWildcardCorsPath(path: string): boolean {
   );
 }
 
-function getCorsPolicy(request: Request): { allowOrigin: string | null; allowCredentials: boolean } {
+function getCorsPolicy(request: Request, env: Env): { allowOrigin: string | null; allowCredentials: boolean } {
   const url = new URL(request.url);
-  const origin = request.headers.get('Origin');
-  if (!origin) {
+  const originHeader = request.headers.get('Origin');
+  if (!originHeader) {
     return isWildcardCorsPath(url.pathname)
       ? { allowOrigin: '*', allowCredentials: false }
       : { allowOrigin: null, allowCredentials: false };
   }
+  const origin = normalizeOrigin(originHeader);
   if (origin === url.origin) {
     return { allowOrigin: origin, allowCredentials: true };
   }
-  if (isExtensionOrigin(origin)) {
+  if (isBrowserExtensionOrigin(origin) && isConfiguredWebAuthnAllowedOrigin(env, origin)) {
     return { allowOrigin: origin, allowCredentials: true };
   }
   if (isWildcardCorsPath(url.pathname)) {
@@ -58,7 +57,7 @@ function getCorsPolicy(request: Request): { allowOrigin: string | null; allowCre
   return { allowOrigin: null, allowCredentials: false };
 }
 
-function buildCorsHeaders(request: Request): Record<string, string> {
+function buildCorsHeaders(request: Request, env: Env): Record<string, string> {
   const requestedHeaders = String(request.headers.get('Access-Control-Request-Headers') || '')
     .split(',')
     .map((value) => value.trim())
@@ -72,7 +71,7 @@ function buildCorsHeaders(request: Request): Record<string, string> {
     'Access-Control-Max-Age': String(LIMITS.cors.preflightMaxAgeSeconds),
   };
 
-  const corsPolicy = getCorsPolicy(request);
+  const corsPolicy = getCorsPolicy(request, env);
   if (corsPolicy.allowOrigin) {
     headers['Access-Control-Allow-Origin'] = corsPolicy.allowOrigin;
     if (corsPolicy.allowCredentials) {
@@ -86,7 +85,8 @@ function buildCorsHeaders(request: Request): Record<string, string> {
 
 export function applyCors(
   request: Request,
-  response: Response
+  response: Response,
+  env: Env
 ): Response {
   // WebSocket upgrade responses must be returned untouched.
   const webSocket = (response as Response & { webSocket?: unknown }).webSocket;
@@ -95,7 +95,7 @@ export function applyCors(
   }
 
   const headers = new Headers(response.headers);
-  const corsHeaders = buildCorsHeaders(request);
+  const corsHeaders = buildCorsHeaders(request, env);
   for (const [k, v] of Object.entries(corsHeaders)) {
     headers.set(k, v);
   }
@@ -159,10 +159,10 @@ export function identityErrorResponse(message: string, error: string = 'invalid_
 }
 
 // Handle CORS preflight
-export function handleCors(request: Request): Response {
+export function handleCors(request: Request, env: Env): Response {
   return new Response(null, {
     status: 204,
-    headers: buildCorsHeaders(request),
+    headers: buildCorsHeaders(request, env),
   });
 }
 

webapp/public/webauthn-fallback-connector.html

@@ -170,6 +170,7 @@
       (function () {
         var params = new URLSearchParams(window.location.search);
         var sentSuccess = false;
+        var allowedParentOriginsPromise = null;
 
         var text = pickText(params.get("locale") || navigator.language || "en");
         document.documentElement.lang = params.get("locale") || navigator.language || "en";
@@ -227,24 +228,55 @@
           return out;
         }
 
-        function trustedParentOrigin() {
-          var parent = decodeRepeated(params.get("parent"));
-          if (!parent) return "";
+        function normalizeOrigin(value) {
+          if (!value) return "";
           try {
-            var parentUrl = new URL(parent);
-            if (
-              parentUrl.protocol === "chrome-extension:" ||
-              parentUrl.protocol === "moz-extension:" ||
-              parentUrl.protocol === "safari-web-extension:"
-            ) {
-              return parentUrl.protocol + "//" + parentUrl.host;
-            }
-            if (parentUrl.origin === window.location.origin) {
-              return parentUrl.origin;
-            }
+            var url = new URL(value);
+            if (!url.protocol || !url.host) return "";
+            return url.protocol + "//" + url.host;
           } catch (_error) {
             return "";
           }
+        }
+
+        function isExtensionOrigin(origin) {
+          return (
+            origin.indexOf("chrome-extension://") === 0 ||
+            origin.indexOf("moz-extension://") === 0 ||
+            origin.indexOf("safari-web-extension://") === 0
+          );
+        }
+
+        function allowedParentOrigins() {
+          if (allowedParentOriginsPromise) return allowedParentOriginsPromise;
+          allowedParentOriginsPromise = fetch("/api/web-bootstrap", {
+            headers: { Accept: "application/json" },
+            credentials: "omit",
+          }).then(function (response) {
+            if (!response.ok) return [];
+            return response.json();
+          }).then(function (body) {
+            var origins = Array.isArray(body && body.webAuthnAllowedOrigins)
+              ? body.webAuthnAllowedOrigins
+              : [];
+            return origins.map(normalizeOrigin).filter(Boolean);
+          }).catch(function () {
+            return [];
+          });
+          return allowedParentOriginsPromise;
+        }
+
+        function trustedParentOrigin(allowedOrigins) {
+          var parent = decodeRepeated(params.get("parent"));
+          if (!parent) return "";
+          var parentOrigin = normalizeOrigin(parent);
+          if (!parentOrigin) return "";
+          if (parentOrigin === window.location.origin) {
+            return parentOrigin;
+          }
+          if (isExtensionOrigin(parentOrigin) && allowedOrigins.indexOf(parentOrigin) >= 0) {
+            return parentOrigin;
+          }
           return "";
         }
 
@@ -258,8 +290,8 @@
           return copy;
         }
 
-        function postResult(message) {
-          var parentOrigin = trustedParentOrigin();
+        async function postResult(message) {
+          var parentOrigin = trustedParentOrigin(await allowedParentOrigins());
           if (parentOrigin) {
             if (window.opener && !window.opener.closed) {
               window.opener.postMessage(message, parentOrigin);
@@ -371,7 +403,7 @@
             if (!(credential instanceof PublicKeyCredential)) {
               throw new Error("No security key was selected.");
             }
-            postResult({
+            await postResult({
               command: "webAuthnResult",
               data: credentialToDataString(credential),
               remember: rememberEl.checked,

webapp/src/App.tsx

@@ -1167,7 +1167,6 @@ export default function App() {
       const key = await encryptSessionUserKeyForAuthRequest(session, authRequest);
       await respondToAuthRequest(authedFetch, authRequest.id, {
         key,
-        masterPasswordHash: null,
         deviceIdentifier: getCurrentDeviceIdentifier(),
         requestApproved: true,
       });
@@ -2121,7 +2120,10 @@ export default function App() {
       const hash = await deriveCurrentMasterPasswordHash(masterPassword);
       return backupActions.downloadRemoteBackup(hash, destinationId, path, onProgress);
     },
-    onInspectRemoteBackup: backupActions.inspectRemoteBackup,
+    onInspectRemoteBackup: async (masterPassword: string, destinationId: string, path: string) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      return backupActions.inspectRemoteBackup(hash, destinationId, path);
+    },
     onDeleteRemoteBackup: async (masterPassword: string, destinationId: string, path: string) => {
       const hash = await deriveCurrentMasterPasswordHash(masterPassword);
       return backupActions.deleteRemoteBackup(hash, destinationId, path);

webapp/src/components/AppMainRoutes.tsx

@@ -168,7 +168,7 @@ export interface AppMainRoutesProps {
   onRunRemoteBackup: (masterPassword: string, destinationId?: string | null) => Promise<AdminBackupRunResponse>;
   onListRemoteBackups: (destinationId: string, path: string) => Promise<RemoteBackupBrowserResponse>;
   onDownloadRemoteBackup: (masterPassword: string, destinationId: string, path: string, onProgress?: (percent: number | null) => void) => Promise<void>;
-  onInspectRemoteBackup: (destinationId: string, path: string) => Promise<{ object: 'backup-remote-integrity'; destinationId: string; path: string; fileName: string; integrity: { hasChecksumPrefix: boolean; expectedPrefix: string | null; actualPrefix: string; matches: boolean } }>;
+  onInspectRemoteBackup: (masterPassword: string, destinationId: string, path: string) => Promise<{ object: 'backup-remote-integrity'; destinationId: string; path: string; fileName: string; integrity: { hasChecksumPrefix: boolean; expectedPrefix: string | null; actualPrefix: string; matches: boolean } }>;
   onDeleteRemoteBackup: (masterPassword: string, destinationId: string, path: string) => Promise<void>;
   onRestoreRemoteBackup: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
   onRestoreRemoteBackupAllowingChecksumMismatch: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;

webapp/src/components/BackupCenterPage.tsx

@@ -42,7 +42,7 @@ interface BackupCenterPageProps {
   onRunRemoteBackup: (masterPassword: string, destinationId?: string | null) => Promise<AdminBackupRunResponse>;
   onListRemoteBackups: (destinationId: string, path: string) => Promise<RemoteBackupBrowserResponse>;
   onDownloadRemoteBackup: (masterPassword: string, destinationId: string, path: string, onProgress?: (percent: number | null) => void) => Promise<void>;
-  onInspectRemoteBackup: (destinationId: string, path: string) => Promise<{ object: 'backup-remote-integrity'; destinationId: string; path: string; fileName: string; integrity: BackupFileIntegrityCheckResult }>;
+  onInspectRemoteBackup: (masterPassword: string, destinationId: string, path: string) => Promise<{ object: 'backup-remote-integrity'; destinationId: string; path: string; fileName: string; integrity: BackupFileIntegrityCheckResult }>;
   onDeleteRemoteBackup: (masterPassword: string, destinationId: string, path: string) => Promise<void>;
   onRestoreRemoteBackup: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
   onRestoreRemoteBackupAllowingChecksumMismatch: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
@@ -492,8 +492,8 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
     return verifyBackupFileIntegrity(bytes, file.name || '');
   }
 
-  async function inspectRemoteBackupFile(destinationId: string, path: string): Promise<PendingRestoreIntegrity> {
-    const payload = await props.onInspectRemoteBackup(destinationId, path);
+  async function inspectRemoteBackupFile(masterPassword: string, destinationId: string, path: string): Promise<PendingRestoreIntegrity> {
+    const payload = await props.onInspectRemoteBackup(masterPassword, destinationId, path);
     return {
       source: 'remote',
       path,
@@ -800,19 +800,7 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
     if (!savedSelectedDestination) return;
     setLocalError('');
     resetPendingIntegrityWarning();
-    try {
-      const integrity = await inspectRemoteBackupFile(savedSelectedDestination.id, path);
-      if (!integrity.result.matches) {
-        setPendingRestoreIntegrity(integrity);
-        setConfirmIntegrityWarningOpen(true);
-        return;
-      }
-      await runRemoteRestore(path, false, false, integrity.result);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : t('txt_backup_integrity_check_failed');
-      setLocalError(message);
-      props.onNotify('error', message);
-    }
+    await runRemoteRestore(path, false);
   }
 
   async function runRemoteRestore(
@@ -846,7 +834,23 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
     setRestoringRemotePath(path);
     setLocalError('');
     try {
-      const integrity = knownIntegrity ? { result: knownIntegrity } : await inspectRemoteBackupFile(savedSelectedDestination.id, path);
+      const integrity = knownIntegrity
+        ? { result: knownIntegrity }
+        : await inspectRemoteBackupFile(masterPassword, savedSelectedDestination.id, path);
+      if (!allowChecksumMismatch && !integrity.result.matches) {
+        setPendingRestoreIntegrity(
+          'source' in integrity
+            ? integrity
+            : {
+              source: 'remote',
+              path,
+              fileName: path.split('/').pop() || path,
+              result: integrity.result,
+            }
+        );
+        setConfirmIntegrityWarningOpen(true);
+        return true;
+      }
       startRestoreProgress('backup-restore', path.split('/').pop() || path, {
         source: 'remote',
         delayMs: replaceExisting ? 480 : 1400,

webapp/src/components/SendsPage.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useRef, useState } from 'preact/hooks';
-import { CheckCheck, ChevronLeft, Copy, Eye, EyeOff, File, FileText, LayoutGrid, Pencil, Plus, RefreshCw, Save, Send as SendIcon, Trash2, X } from 'lucide-preact';
+import { CheckCheck, ChevronLeft, Copy, Eye, EyeOff, File, FileText, LayoutGrid, Lock, Pencil, Plus, RefreshCw, Save, Send as SendIcon, Trash2, X } from 'lucide-preact';
 import { copyTextToClipboard } from '@/lib/clipboard';
 import LoadingState from '@/components/LoadingState';
 import type { Send, SendDraft } from '@/lib/types';
@@ -43,6 +43,7 @@ function buildDefaultDraft(): SendDraft {
     expirationDays: '0',
     maxAccessCount: '',
     password: '',
+    hasPassword: false,
     disabled: false,
   };
 }
@@ -59,6 +60,7 @@ function draftFromSend(send: Send): SendDraft {
     expirationDays: daysFromNow(send.expirationDate, 0),
     maxAccessCount: send.maxAccessCount !== null && send.maxAccessCount !== undefined ? String(send.maxAccessCount) : '',
     password: '',
+    hasPassword: !!send.password,
     disabled: !!send.disabled,
   };
 }
@@ -380,6 +382,7 @@ export default function SendsPage(props: SendsPageProps) {
                 <div className="list-text">
                   <span className="list-title" title={send.decName || t('txt_no_name')}>{send.decName || t('txt_no_name')}</span>
                   <span className="list-sub">
+                    {!!send.password && <><Lock size={12} className="inline-icon" /> </>}
                     {Number(send.type) === 1 ? t('txt_file') : t('txt_text')} - {t('txt_accessed_count_times', { count: send.accessCount || 0 })}
                   </span>
                 </div>
@@ -471,12 +474,23 @@ export default function SendsPage(props: SendsPageProps) {
               </label>
               <label className="field">
                 <span>{t('txt_password')}</span>
-                <div className="password-wrap">
-                  <input className="input" type={showPassword ? 'text' : 'password'} value={draft.password} onInput={(e) => setDraft({ ...draft, password: (e.currentTarget as HTMLInputElement).value })} />
-                  <button type="button" className="password-toggle" onClick={() => setShowPassword((v) => !v)}>
-                    {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
-                  </button>
-                </div>
+                {draft.hasPassword ? (
+                  <div className="password-wrap">
+                    <input className="input" type="password" value="••••••••" disabled />
+                    {!isCreating && (
+                      <button type="button" className="password-toggle text-red-600 hover:text-red-700" onClick={() => setDraft({ ...draft, hasPassword: false, password: '' })} title={t('txt_remove')}>
+                        <Trash2 size={16} />
+                      </button>
+                    )}
+                  </div>
+                ) : (
+                  <div className="password-wrap">
+                    <input className="input" type={showPassword ? 'text' : 'password'} value={draft.password} onInput={(e) => setDraft({ ...draft, password: (e.currentTarget as HTMLInputElement).value })} />
+                    <button type="button" className="password-toggle" onClick={() => setShowPassword((v) => !v)}>
+                      {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
+                    </button>
+                  </div>
+                )}
               </label>
               <label className="field field-span-2">
                 <span>{t('txt_notes')}</span>

webapp/src/components/TotpCodesPage.tsx

@@ -1,7 +1,7 @@
 import { useEffect, useMemo, useRef, useState } from 'preact/hooks';
 import { Clipboard, Globe } from 'lucide-preact';
 import { copyTextToClipboard as copyTextWithFeedback } from '@/lib/clipboard';
-import { calcTotpNow } from '@/lib/crypto';
+import { calcTotpNow, type TotpCodeResult } from '@/lib/crypto';
 import { t } from '@/lib/i18n';
 import type { Cipher } from '@/lib/types';
 import LoadingState from '@/components/LoadingState';
@@ -14,17 +14,9 @@ interface TotpCodesPageProps {
   onNotify: (type: 'success' | 'error', text: string) => void;
 }
 
-const TOTP_PERIOD_SECONDS = 30;
 const TOTP_RING_RADIUS = 14;
 const TOTP_RING_CIRCUMFERENCE = 2 * Math.PI * TOTP_RING_RADIUS;
 const TOTP_REFRESH_BATCH_SIZE = 16;
-function getTotpTimeState(): { windowId: number; remain: number } {
-  const epoch = Math.floor(Date.now() / 1000);
-  return {
-    windowId: Math.floor(epoch / TOTP_PERIOD_SECONDS),
-    remain: TOTP_PERIOD_SECONDS - (epoch % TOTP_PERIOD_SECONDS),
-  };
-}
 
 function TotpListIcon({ cipher }: { cipher: Cipher }) {
   return <WebsiteIcon cipher={cipher} fallback={<Globe size={18} />} />;
@@ -32,13 +24,15 @@ function TotpListIcon({ cipher }: { cipher: Cipher }) {
 
 interface TotpRowProps {
   cipher: Cipher;
-  live: { code: string; remain: number } | null;
+  live: TotpCodeResult | null;
   onCopy: (value: string) => void;
 }
 
 function TotpRow(props: TotpRowProps) {
   const name = props.cipher.decName || props.cipher.name || t('txt_no_name');
   const username = props.cipher.login?.decUsername || '';
+  const period = Math.max(1, props.live?.period || 30);
+  const progress = props.live ? Math.max(0, Math.min(period, props.live.remain)) / period : 0;
 
   return (
     <div className="totp-code-row">
@@ -69,8 +63,7 @@ function TotpRow(props: TotpRowProps) {
                 strokeDasharray: `${TOTP_RING_CIRCUMFERENCE} ${TOTP_RING_CIRCUMFERENCE}`,
                 strokeDashoffset: String(
                   TOTP_RING_CIRCUMFERENCE -
-                    TOTP_RING_CIRCUMFERENCE *
-                      (Math.max(0, Math.min(TOTP_PERIOD_SECONDS, props.live?.remain ?? 0)) / TOTP_PERIOD_SECONDS)
+                    TOTP_RING_CIRCUMFERENCE * progress
                 ),
               }}
             />
@@ -86,8 +79,7 @@ function TotpRow(props: TotpRowProps) {
 }
 
 export default function TotpCodesPage(props: TotpCodesPageProps) {
-  const [totpCodes, setTotpCodes] = useState<Record<string, string | null>>({});
-  const [remainingSeconds, setRemainingSeconds] = useState(() => getTotpTimeState().remain);
+  const [totpCodes, setTotpCodes] = useState<Record<string, TotpCodeResult | null>>({});
   const [columnCount, setColumnCount] = useState(1);
   const listRef = useRef<HTMLDivElement | null>(null);
 
@@ -120,11 +112,10 @@ export default function TotpCodesPage(props: TotpCodesPageProps) {
     let stopped = false;
     let activeRun = 0;
     let timer = 0;
-    let currentWindowId = -1;
 
     const refreshCodes = async () => {
       const runId = ++activeRun;
-      const nextCodes: Record<string, string | null> = {};
+      const nextCodes: Record<string, TotpCodeResult | null> = {};
       for (let start = 0; start < totpItems.length; start += TOTP_REFRESH_BATCH_SIZE) {
         if (stopped || runId !== activeRun) return;
         const batch = totpItems.slice(start, start + TOTP_REFRESH_BATCH_SIZE);
@@ -132,7 +123,7 @@ export default function TotpCodesPage(props: TotpCodesPageProps) {
           batch.map(async (cipher) => {
             try {
               const next = await calcTotpNow(cipher.login?.decTotp || '');
-              return [cipher.id, next?.code || null] as const;
+              return [cipher.id, next] as const;
             } catch {
               return [cipher.id, null] as const;
             }
@@ -146,15 +137,20 @@ export default function TotpCodesPage(props: TotpCodesPageProps) {
       if (stopped || runId !== activeRun) return;
       setTotpCodes((prev) => {
         let changed = false;
-        const next: Record<string, string | null> = { ...prev };
+        const next: Record<string, TotpCodeResult | null> = { ...prev };
         for (const id of Object.keys(next)) {
           if (id in nextCodes) continue;
           delete next[id];
           changed = true;
         }
-        for (const [id, code] of Object.entries(nextCodes)) {
-          if (next[id] === code) continue;
-          next[id] = code;
+        for (const [id, live] of Object.entries(nextCodes)) {
+          const prevLive = next[id];
+          if (
+            prevLive?.code === live?.code &&
+            prevLive?.remain === live?.remain &&
+            prevLive?.period === live?.period
+          ) continue;
+          next[id] = live;
           changed = true;
         }
         return changed ? next : prev;
@@ -162,10 +158,6 @@ export default function TotpCodesPage(props: TotpCodesPageProps) {
     };
 
     const tick = () => {
-      const next = getTotpTimeState();
-      setRemainingSeconds((prev) => (prev === next.remain ? prev : next.remain));
-      if (next.windowId === currentWindowId) return;
-      currentWindowId = next.windowId;
       void refreshCodes();
     };
 
@@ -215,7 +207,7 @@ export default function TotpCodesPage(props: TotpCodesPageProps) {
             <TotpRow
               key={cipher.id}
               cipher={cipher}
-              live={totpCodes[cipher.id] ? { code: totpCodes[cipher.id] || '', remain: remainingSeconds } : null}
+              live={totpCodes[cipher.id] || null}
               onCopy={(value) => void copyToClipboard(value)}
             />
           ))}

webapp/src/components/VaultPage.tsx

@@ -31,7 +31,7 @@ import {
   type SidebarFilter,
   type VaultSortMode,
 } from '@/components/vault/vault-page-helpers';
-import { calcTotpNow } from '@/lib/crypto';
+import { calcTotpNow, type TotpCodeResult } from '@/lib/crypto';
 import { computeSshFingerprint, generateDefaultSshKeyMaterial } from '@/lib/ssh';
 import { ChevronLeft } from 'lucide-preact';
 import type { Cipher, CustomFieldType, Folder, VaultDraft, VaultDraftField } from '@/lib/types';
@@ -109,7 +109,7 @@ export default function VaultPage(props: VaultPageProps) {
   const [renameFolderName, setRenameFolderName] = useState('');
   const [pendingDeleteFolder, setPendingDeleteFolder] = useState<Folder | null>(null);
   const [deleteAllFoldersOpen, setDeleteAllFoldersOpen] = useState(false);
-  const [totpLive, setTotpLive] = useState<{ code: string; remain: number } | null>(null);
+  const [totpLive, setTotpLive] = useState<TotpCodeResult | null>(null);
   const [hiddenFieldVisibleMap, setHiddenFieldVisibleMap] = useState<Record<number, boolean>>({});
   const [attachmentQueue, setAttachmentQueue] = useState<File[]>([]);
   const [removedAttachmentIds, setRemovedAttachmentIds] = useState<Record<string, boolean>>({});

webapp/src/components/vault/VaultDetailView.tsx

@@ -2,11 +2,11 @@ import { createPortal } from 'preact/compat';
 import { useEffect, useMemo, useState } from 'preact/hooks';
 import { Archive, Clipboard, Download, Eye, EyeOff, ExternalLink, Folder, Paperclip, Pencil, RotateCcw, Trash2, X } from 'lucide-preact';
 import { useDialogLifecycle } from '@/components/ConfirmDialog';
+import type { TotpCodeResult } from '@/lib/crypto';
 import type { Cipher } from '@/lib/types';
 import { t } from '@/lib/i18n';
 import {
   CardBrandIcon,
-  TOTP_PERIOD_SECONDS,
   TOTP_RING_CIRCUMFERENCE,
   VaultListIcon,
   copyToClipboard,
@@ -25,7 +25,7 @@ interface VaultDetailViewProps {
   selectedCipher: Cipher;
   repromptApprovedCipherId: string | null;
   showPassword: boolean;
-  totpLive: { code: string; remain: number } | null;
+  totpLive: TotpCodeResult | null;
   passkeyCreatedAt: string | null;
   hiddenFieldVisibleMap: Record<number, boolean>;
   folderName: (id: string | null | undefined) => string;
@@ -42,6 +42,11 @@ interface VaultDetailViewProps {
   onUnarchive: (cipher: Cipher) => void | Promise<void>;
 }
 
+function totpProgress(live: TotpCodeResult | null): number {
+  const period = Math.max(1, live?.period || 30);
+  return live ? Math.max(0, Math.min(period, live.remain)) / period : 0;
+}
+
 function PasswordHistoryDialog(props: {
   open: boolean;
   entries: Array<{ password: string; lastUsedDate: string | null }>;
@@ -191,8 +196,7 @@ export default function VaultDetailView(props: VaultDetailViewProps) {
                               strokeDasharray: `${TOTP_RING_CIRCUMFERENCE} ${TOTP_RING_CIRCUMFERENCE}`,
                               strokeDashoffset: String(
                                 TOTP_RING_CIRCUMFERENCE -
-                                  TOTP_RING_CIRCUMFERENCE *
-                                    (Math.max(0, Math.min(TOTP_PERIOD_SECONDS, props.totpLive?.remain ?? 0)) / TOTP_PERIOD_SECONDS)
+                                  TOTP_RING_CIRCUMFERENCE * totpProgress(props.totpLive)
                               ),
                             }}
                           />

webapp/src/components/vault/VaultEditor.tsx

@@ -4,6 +4,7 @@ import { ArrowDown, ArrowUp, CheckCheck, Download, Paperclip, Plus, QrCode, Refr
 import jsQR from 'jsqr';
 import { useEffect, useRef, useState } from 'preact/hooks';
 import { useDialogLifecycle } from '@/components/ConfirmDialog';
+import { normalizeTotpInput } from '@/lib/crypto';
 import type { Cipher, Folder, VaultDraft, VaultDraftField } from '@/lib/types';
 import { t } from '@/lib/i18n';
 import { cardBrand } from '@/lib/import-format-shared';
@@ -161,9 +162,9 @@ export default function VaultEditor(props: VaultEditorProps) {
   };
 
   const applyTotpQrValue = (value: string) => {
-    const trimmed = value.trim();
-    if (!trimmed) return false;
-    props.onUpdateDraft({ loginTotp: trimmed });
+    const normalized = normalizeTotpInput(value);
+    if (!normalized) return false;
+    props.onUpdateDraft({ loginTotp: normalized });
     setTotpQrStatus(t('txt_totp_qr_scanned'));
     setTotpQrOpen(false);
     return true;

webapp/src/components/vault/WebsiteIcon.tsx

@@ -10,6 +10,7 @@ import {
 } from '@/lib/website-icon-cache';
 import { demoBrandIconUrl } from '@/lib/demo-brand-icons';
 import { getCurrentNetworkStatus, subscribeNetworkStatus } from '@/lib/network-status';
+import { areWebsiteIconsEnabled } from '@/lib/website-icon-settings';
 import { firstCipherUri, hostFromUri, websiteIconUrl } from '@/lib/website-utils';
 
 const ICON_LOAD_ROOT_MARGIN = '180px 0px';
@@ -22,7 +23,8 @@ interface WebsiteIconProps {
 
 export default function WebsiteIcon(props: WebsiteIconProps) {
   const host = useMemo(() => hostFromUri(firstCipherUri(props.cipher)), [props.cipher]);
-  const src = host ? websiteIconUrl(host) : '';
+  const iconsEnabled = areWebsiteIconsEnabled();
+  const src = iconsEnabled && host ? websiteIconUrl(host) : '';
   const nodeRef = useRef<HTMLSpanElement | null>(null);
   const [shouldLoad, setShouldLoad] = useState(() => (host ? getWebsiteIconStatus(host) === 'loaded' : true));
   const [status, setStatus] = useState(() => (host ? getWebsiteIconStatus(host) : 'idle'));
@@ -33,7 +35,7 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
   useEffect(() => subscribeNetworkStatus(setNetworkStatus), []);
 
   useEffect(() => {
-    if (!host) {
+    if (!host || !iconsEnabled) {
       setShouldLoad(true);
       setStatus('idle');
       setImageUrl('');
@@ -47,7 +49,7 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
       setStatus(next);
       setImageUrl(getWebsiteIconImageUrl(host));
     });
-  }, [host]);
+  }, [host, iconsEnabled]);
 
   useEffect(() => {
     if (!host || shouldLoad || status === 'loaded' || status === 'error') return;
@@ -81,10 +83,11 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
   useEffect(() => {
     if (SHOULD_LOAD_DEMO_BRAND_ICONS) return;
     if (demoIconUrl) return;
+    if (!iconsEnabled) return;
     if (networkStatus !== 'online') return;
     if (!host || !src || !shouldLoad || status !== 'idle') return;
     beginWebsiteIconLoad(host, src);
-  }, [demoIconUrl, host, networkStatus, src, shouldLoad, status]);
+  }, [demoIconUrl, host, iconsEnabled, networkStatus, src, shouldLoad, status]);
 
   if (demoIconUrl) {
     return (
@@ -100,7 +103,7 @@ export default function WebsiteIcon(props: WebsiteIconProps) {
     );
   }
 
-  if (!host || status === 'error') {
+  if (!host || !iconsEnabled || status === 'error') {
     return <span className="list-icon-fallback">{props.fallback ?? <Globe size={18} />}</span>;
   }
 

webapp/src/components/vault/vault-page-helpers.tsx

@@ -207,8 +207,7 @@ export function getWebsiteMatchOptions(): Array<{ value: number | null; label: s
   ];
 }
 
-export const TOTP_PERIOD_SECONDS = 30;
-export const TOTP_RING_RADIUS = 14;
+const TOTP_RING_RADIUS = 14;
 export const TOTP_RING_CIRCUMFERENCE = 2 * Math.PI * TOTP_RING_RADIUS;
 
 export function CreateTypeIcon({ type }: { type: number }) {

webapp/src/hooks/useBackupActions.ts

@@ -82,8 +82,8 @@ export default function useBackupActions(options: UseBackupActionsOptions) {
         downloadBytesAsFile(payload.bytes, payload.fileName, payload.mimeType);
       },
 
-      async inspectRemoteBackup(destinationId: string, path: string) {
-        return inspectRemoteBackupIntegrity(authedFetch, destinationId, path);
+      async inspectRemoteBackup(masterPasswordHash: string, destinationId: string, path: string) {
+        return inspectRemoteBackupIntegrity(authedFetch, masterPasswordHash, destinationId, path);
       },
 
       async deleteRemoteBackup(masterPasswordHash: string, destinationId: string, path: string) {

webapp/src/lib/api/auth-requests.ts

@@ -52,7 +52,6 @@ export async function respondToAuthRequest(
   requestId: string,
   payload: {
     key?: string | null;
-    masterPasswordHash?: string | null;
     deviceIdentifier: string;
     requestApproved: boolean;
   }

webapp/src/lib/api/backup.ts

@@ -196,11 +196,14 @@ export async function exportAdminBackup(
 
 export async function downloadAdminBackupAttachmentBlob(
   authedFetch: AuthedFetch,
-  blobName: string
+  blobName: string,
+  masterPasswordHash: string
 ): Promise<Uint8Array> {
-  const params = new URLSearchParams();
-  params.set('blobName', blobName);
-  const resp = await authedFetch(`/api/admin/backup/blob?${params.toString()}`, { method: 'GET' });
+  const resp = await authedFetch('/api/admin/backup/blob', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ blobName, masterPasswordHash }),
+  });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_export_failed')));
   return new Uint8Array(await resp.arrayBuffer());
 }
@@ -246,7 +249,7 @@ export async function buildCompleteAdminBackupExport(
     stageDetail: 'txt_backup_export_progress_fetch_attachments_detail',
   });
   for (const attachment of manifest.attachmentBlobs || []) {
-    const bytes = await downloadAdminBackupAttachmentBlob(authedFetch, attachment.blobName);
+    const bytes = await downloadAdminBackupAttachmentBlob(authedFetch, attachment.blobName, masterPasswordHash);
     zipped[`attachments/${attachment.cipherId}/${attachment.attachmentId}.bin`] = bytes;
   }
 
@@ -417,13 +420,15 @@ export async function deleteRemoteBackup(
 
 export async function inspectRemoteBackupIntegrity(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   destinationId: string,
   path: string
 ): Promise<RemoteBackupIntegrityResponse> {
-  const params = new URLSearchParams();
-  params.set('destinationId', destinationId);
-  params.set('path', path);
-  const resp = await authedFetch(`/api/admin/backup/remote/integrity?${params.toString()}`, { method: 'GET' });
+  const resp = await authedFetch('/api/admin/backup/remote/integrity', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ destinationId, path, masterPasswordHash }),
+  });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_remote_download_failed')));
   const body = await parseJson<RemoteBackupIntegrityResponse>(resp);
   if (!body?.integrity || !body?.fileName) throw new Error(t('txt_backup_remote_invalid_response'));

webapp/src/lib/app-auth.ts

@@ -27,6 +27,7 @@ import {
   unlockOfflineVaultWithMasterKey,
 } from '@/lib/offline-auth';
 import { probeNodeWardenService } from '@/lib/network-status';
+import { setWebsiteIconsEnabled } from '@/lib/website-icon-settings';
 import type { AccountPasskeyPrfOption, AppPhase, Profile, SessionState, TokenSuccess, WebBootstrapResponse } from '@/lib/types';
 
 export interface PendingTotp {
@@ -51,6 +52,7 @@ export type JwtUnsafeReason = 'missing' | 'too_short';
 export interface BootstrapAppResult {
   defaultKdfIterations: number;
   registrationInviteRequired?: boolean;
+  websiteIconsEnabled: boolean;
   jwtWarning: { reason: JwtUnsafeReason; minLength: number } | null;
   session: SessionState | null;
   profile: Profile | null;
@@ -61,6 +63,7 @@ export interface BootstrapAppResult {
 export interface InitialAppBootstrapState {
   defaultKdfIterations: number;
   registrationInviteRequired?: boolean;
+  websiteIconsEnabled: boolean;
   jwtWarning: { reason: JwtUnsafeReason; minLength: number } | null;
   session: SessionState | null;
   phase: AppPhase;
@@ -229,10 +232,11 @@ function readWindowBootstrap(): WebBootstrapResponse {
   return raw && typeof raw === 'object' ? raw : {};
 }
 
-function normalizeBootstrapResponse(boot: WebBootstrapResponse): Pick<InitialAppBootstrapState, 'defaultKdfIterations' | 'registrationInviteRequired' | 'jwtWarning'> {
+function normalizeBootstrapResponse(boot: WebBootstrapResponse): Pick<InitialAppBootstrapState, 'defaultKdfIterations' | 'registrationInviteRequired' | 'websiteIconsEnabled' | 'jwtWarning'> {
   const defaultKdfIterations = Number(boot.defaultKdfIterations || 600000);
   const registrationInviteRequired =
     typeof boot.registrationInviteRequired === 'boolean' ? boot.registrationInviteRequired : undefined;
+  const websiteIconsEnabled = boot.websiteIconsEnabled !== false;
   const jwtUnsafeReason = boot.jwtUnsafeReason || null;
   const jwtWarning = jwtUnsafeReason
     ? {
@@ -244,6 +248,7 @@ function normalizeBootstrapResponse(boot: WebBootstrapResponse): Pick<InitialApp
   return {
     defaultKdfIterations,
     registrationInviteRequired,
+    websiteIconsEnabled,
     jwtWarning,
   };
 }
@@ -304,7 +309,8 @@ function resolveUnauthenticatedPhase(registrationInviteRequired: boolean | undef
 }
 
 export function readInitialAppBootstrapState(): InitialAppBootstrapState {
-  const { defaultKdfIterations, registrationInviteRequired, jwtWarning } = normalizeBootstrapResponse(readWindowBootstrap());
+  const { defaultKdfIterations, registrationInviteRequired, websiteIconsEnabled, jwtWarning } = normalizeBootstrapResponse(readWindowBootstrap());
+  setWebsiteIconsEnabled(websiteIconsEnabled);
   const session = loadSession();
   const hasInviteCode = !!readInviteCodeFromUrl();
   const unauthenticatedPhase = hasInviteCode ? 'register' : 'login';
@@ -312,6 +318,7 @@ export function readInitialAppBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations,
     registrationInviteRequired,
+    websiteIconsEnabled,
     jwtWarning,
     session,
     phase: jwtWarning ? 'login' : session ? 'locked' : resolveUnauthenticatedPhase(registrationInviteRequired, unauthenticatedPhase),
@@ -323,12 +330,15 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
   const normalizedBoot = normalizeBootstrapResponse(remoteBoot);
   const defaultKdfIterations = normalizedBoot.defaultKdfIterations || initial.defaultKdfIterations;
   const registrationInviteRequired = normalizedBoot.registrationInviteRequired ?? initial.registrationInviteRequired;
+  const websiteIconsEnabled = normalizedBoot.websiteIconsEnabled !== false;
+  setWebsiteIconsEnabled(websiteIconsEnabled);
   const jwtWarning = normalizedBoot.jwtWarning ?? initial.jwtWarning;
 
   if (jwtWarning) {
     return {
       defaultKdfIterations,
       registrationInviteRequired,
+      websiteIconsEnabled,
       jwtWarning,
       session: null,
       profile: null,
@@ -341,6 +351,7 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
     return {
       defaultKdfIterations,
       registrationInviteRequired,
+      websiteIconsEnabled,
       jwtWarning: null,
       session: null,
       profile: null,
@@ -353,6 +364,7 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
     return {
       defaultKdfIterations,
       registrationInviteRequired,
+      websiteIconsEnabled,
       jwtWarning: null,
       session: loaded,
       profile: cachedProfile,
@@ -364,6 +376,7 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
   return {
     defaultKdfIterations,
     registrationInviteRequired,
+    websiteIconsEnabled,
     jwtWarning: null,
     session: loaded,
     profile: null,

webapp/src/lib/crypto.ts

@@ -259,17 +259,33 @@ interface TotpConfig {
   period: number;
 }
 
+interface GoogleAuthenticatorMigrationTotp {
+  secret: string;
+  name: string;
+  issuer: string;
+  algorithm: TotpHashAlgorithm;
+  digits: number;
+  period: number;
+}
+
 const DEFAULT_TOTP_CONFIG: Omit<TotpConfig, 'secret' | 'steam'> = {
   algorithm: 'SHA-1',
   digits: 6,
   period: 30,
 };
 
-function parseTotpPositiveInt(value: string | null, fallback: number, min: number, max: number): number {
-  if (!value) return fallback;
+function parseTotpDigits(value: string | null): number {
+  if (!value) return DEFAULT_TOTP_CONFIG.digits;
   const parsed = Number(value);
-  if (!Number.isInteger(parsed) || parsed < min || parsed > max) return fallback;
-  return parsed;
+  if (!Number.isInteger(parsed)) return DEFAULT_TOTP_CONFIG.digits;
+  return Math.max(0, Math.min(10, parsed));
+}
+
+function parseTotpPeriod(value: string | null): number {
+  if (!value) return DEFAULT_TOTP_CONFIG.period;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed)) return DEFAULT_TOTP_CONFIG.period;
+  return Math.max(1, parsed);
 }
 
 function parseTotpHashAlgorithm(value: string | null): TotpHashAlgorithm {
@@ -279,9 +295,190 @@ function parseTotpHashAlgorithm(value: string | null): TotpHashAlgorithm {
   return 'SHA-1';
 }
 
-function parseTotpConfig(raw: string): TotpConfig {
-  if (!raw) return { secret: '', steam: false, ...DEFAULT_TOTP_CONFIG };
+function base64ToBytesLoose(value: string): Uint8Array {
+  const normalized = value.trim().replace(/\s/g, '+').replace(/-/g, '+').replace(/_/g, '/');
+  if (!normalized) return new Uint8Array();
+  const padded = normalized + '='.repeat((4 - (normalized.length % 4)) % 4);
+  try {
+    const binary = atob(padded);
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  } catch {
+    return new Uint8Array();
+  }
+}
+
+function bytesToBase32(bytes: Uint8Array): string {
+  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+  let bits = 0;
+  let value = 0;
+  let out = '';
+  for (const byte of bytes) {
+    value = (value << 8) | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += alphabet[(value >>> (bits - 5)) & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    out += alphabet[(value << (5 - bits)) & 31];
+  }
+  return out;
+}
+
+function readProtoVarint(bytes: Uint8Array, state: { offset: number }): number | null {
+  let result = 0;
+  let factor = 1;
+  for (let i = 0; i < 10 && state.offset < bytes.length; i += 1) {
+    const byte = bytes[state.offset++];
+    result += (byte & 0x7f) * factor;
+    if ((byte & 0x80) === 0) return Number.isSafeInteger(result) ? result : null;
+    factor *= 128;
+  }
+  return null;
+}
+
+function readProtoBytes(bytes: Uint8Array, state: { offset: number }): Uint8Array | null {
+  const length = readProtoVarint(bytes, state);
+  if (length == null || length < 0 || state.offset + length > bytes.length) return null;
+  const out = bytes.slice(state.offset, state.offset + length);
+  state.offset += length;
+  return out;
+}
+
+function skipProtoField(bytes: Uint8Array, state: { offset: number }, wireType: number): boolean {
+  if (wireType === 0) return readProtoVarint(bytes, state) != null;
+  if (wireType === 1 && state.offset + 8 <= bytes.length) {
+    state.offset += 8;
+    return true;
+  }
+  if (wireType === 2) return readProtoBytes(bytes, state) != null;
+  if (wireType === 5 && state.offset + 4 <= bytes.length) {
+    state.offset += 4;
+    return true;
+  }
+  return false;
+}
+
+function googleMigrationAlgorithm(value: number): TotpHashAlgorithm | null {
+  if (value === 0 || value === 1) return 'SHA-1';
+  if (value === 2) return 'SHA-256';
+  if (value === 3) return 'SHA-512';
+  return null;
+}
+
+function googleMigrationDigits(value: number): number {
+  if (value === 2) return 8;
+  return 6;
+}
+
+function parseGoogleMigrationOtpParameter(bytes: Uint8Array): GoogleAuthenticatorMigrationTotp | null {
+  const state = { offset: 0 };
+  let secretBytes: Uint8Array | null = null;
+  let name = '';
+  let issuer = '';
+  let algorithm: TotpHashAlgorithm | null = 'SHA-1';
+  let digits = 6;
+  let otpType = 0;
+  const decoder = new TextDecoder();
+
+  while (state.offset < bytes.length) {
+    const key = readProtoVarint(bytes, state);
+    if (key == null) return null;
+    const fieldNumber = Math.floor(key / 8);
+    const wireType = key % 8;
+
+    if (fieldNumber === 1 && wireType === 2) {
+      secretBytes = readProtoBytes(bytes, state);
+    } else if (fieldNumber === 2 && wireType === 2) {
+      const value = readProtoBytes(bytes, state);
+      name = value ? decoder.decode(value) : '';
+    } else if (fieldNumber === 3 && wireType === 2) {
+      const value = readProtoBytes(bytes, state);
+      issuer = value ? decoder.decode(value) : '';
+    } else if (fieldNumber === 4 && wireType === 0) {
+      const value = readProtoVarint(bytes, state);
+      algorithm = value == null ? null : googleMigrationAlgorithm(value);
+    } else if (fieldNumber === 5 && wireType === 0) {
+      const value = readProtoVarint(bytes, state);
+      digits = googleMigrationDigits(value ?? 0);
+    } else if (fieldNumber === 6 && wireType === 0) {
+      otpType = readProtoVarint(bytes, state) ?? 0;
+    } else if (!skipProtoField(bytes, state, wireType)) {
+      return null;
+    }
+  }
+
+  if (!secretBytes?.length || !algorithm || otpType === 1) return null;
+  return {
+    secret: bytesToBase32(secretBytes),
+    name,
+    issuer,
+    algorithm,
+    digits,
+    period: DEFAULT_TOTP_CONFIG.period,
+  };
+}
+
+function parseGoogleAuthenticatorMigration(raw: string): GoogleAuthenticatorMigrationTotp[] {
+  let data = '';
+  try {
+    data = new URL(raw).searchParams.get('data') || '';
+  } catch {
+    data = readOtpAuthParam(raw, 'data');
+  }
+  const bytes = base64ToBytesLoose(data);
+  if (!bytes.length) return [];
+
+  const state = { offset: 0 };
+  const out: GoogleAuthenticatorMigrationTotp[] = [];
+  while (state.offset < bytes.length) {
+    const key = readProtoVarint(bytes, state);
+    if (key == null) return [];
+    const fieldNumber = Math.floor(key / 8);
+    const wireType = key % 8;
+    if (fieldNumber === 1 && wireType === 2) {
+      const parameterBytes = readProtoBytes(bytes, state);
+      const parameter = parameterBytes ? parseGoogleMigrationOtpParameter(parameterBytes) : null;
+      if (parameter) out.push(parameter);
+    } else if (!skipProtoField(bytes, state, wireType)) {
+      return [];
+    }
+  }
+  return out;
+}
+
+function buildOtpAuthUri(account: GoogleAuthenticatorMigrationTotp): string {
+  const issuer = account.issuer.trim();
+  const name = account.name.trim();
+  const label = issuer && name && !name.toLowerCase().startsWith(`${issuer.toLowerCase()}:`)
+    ? `${issuer}:${name}`
+    : name || issuer || 'TOTP';
+  const params = new URLSearchParams({
+    secret: account.secret,
+    algorithm: account.algorithm.replace('-', ''),
+    digits: String(account.digits),
+    period: String(account.period),
+  });
+  if (issuer) params.set('issuer', issuer);
+  return `otpauth://totp/${encodeURIComponent(label)}?${params.toString()}`;
+}
+
+export function normalizeTotpInput(raw: string): string {
   const s = raw.trim();
+  if (!s) return '';
+  if (/^otpauth-migration:\/\//i.test(s)) {
+    const accounts = parseGoogleAuthenticatorMigration(s);
+    return accounts.length === 1 ? buildOtpAuthUri(accounts[0]) : '';
+  }
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s) && !/^otpauth:\/\//i.test(s) && !/^steam:\/\//i.test(s)) {
+    return '';
+  }
+  return s;
+}
+
+function parseTotpConfig(raw: string): TotpConfig {
+  const s = normalizeTotpInput(raw);
   if (!s) return { secret: '', steam: false, ...DEFAULT_TOTP_CONFIG };
   if (/^steam:\/\//i.test(s)) {
     return {
@@ -295,31 +492,20 @@ function parseTotpConfig(raw: string): TotpConfig {
   if (/^otpauth:\/\//i.test(s)) {
     try {
       const u = new URL(s);
-      const otpType = u.hostname.toLowerCase();
-      if (otpType !== 'totp') {
-        return { secret: '', steam: false, ...DEFAULT_TOTP_CONFIG };
-      }
-      const label = decodeURIComponent((u.pathname || '').replace(/^\/+/, '')).toLowerCase();
-      const issuer = (u.searchParams.get('issuer') || '').trim().toLowerCase();
-      const algorithm = (u.searchParams.get('algorithm') || '').trim().toLowerCase();
-      const steam = issuer === 'steam' || label.startsWith('steam:') || algorithm === 'steam';
       return {
         secret: normalizeTotpSecret(u.searchParams.get('secret') || ''),
-        steam,
-        algorithm: steam ? 'SHA-1' : parseTotpHashAlgorithm(u.searchParams.get('algorithm')),
-        digits: steam ? 5 : parseTotpPositiveInt(u.searchParams.get('digits'), DEFAULT_TOTP_CONFIG.digits, 1, 10),
-        period: parseTotpPositiveInt(u.searchParams.get('period'), DEFAULT_TOTP_CONFIG.period, 1, 3600),
+        steam: false,
+        algorithm: parseTotpHashAlgorithm(u.searchParams.get('algorithm')),
+        digits: parseTotpDigits(u.searchParams.get('digits')),
+        period: parseTotpPeriod(u.searchParams.get('period')),
       };
     } catch {
-      const issuer = readOtpAuthParam(s, 'issuer').trim().toLowerCase();
-      const algorithm = readOtpAuthParam(s, 'algorithm').trim().toLowerCase();
-      const steam = issuer === 'steam' || algorithm === 'steam';
       return {
         secret: normalizeTotpSecret(readOtpAuthParam(s, 'secret')),
-        steam,
-        algorithm: steam ? 'SHA-1' : parseTotpHashAlgorithm(algorithm),
-        digits: steam ? 5 : parseTotpPositiveInt(readOtpAuthParam(s, 'digits'), DEFAULT_TOTP_CONFIG.digits, 1, 10),
-        period: parseTotpPositiveInt(readOtpAuthParam(s, 'period'), DEFAULT_TOTP_CONFIG.period, 1, 3600),
+        steam: false,
+        algorithm: parseTotpHashAlgorithm(readOtpAuthParam(s, 'algorithm')),
+        digits: parseTotpDigits(readOtpAuthParam(s, 'digits')),
+        period: parseTotpPeriod(readOtpAuthParam(s, 'period')),
       };
     }
   }
@@ -349,7 +535,13 @@ function base32ToBytes(input: string): Uint8Array {
   return new Uint8Array(out);
 }
 
-export async function calcTotpNow(rawSecret: string, nowMs: number = Date.now()): Promise<{ code: string; remain: number } | null> {
+export interface TotpCodeResult {
+  code: string;
+  remain: number;
+  period: number;
+}
+
+export async function calcTotpNow(rawSecret: string, nowMs: number = Date.now()): Promise<TotpCodeResult | null> {
   const { secret, steam, algorithm, digits, period } = parseTotpConfig(rawSecret);
   if (!secret) return null;
   const keyBytes = base32ToBytes(secret);
@@ -378,5 +570,5 @@ export async function calcTotpNow(rawSecret: string, nowMs: number = Date.now())
       value = Math.floor(value / chars.length);
     }
   }
-  return { code, remain };
+  return { code, remain, period };
 }

webapp/src/lib/demo.empty.ts

@@ -20,6 +20,7 @@ export function createDemoInitialBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations: 600000,
     registrationInviteRequired: true,
+    websiteIconsEnabled: true,
     jwtWarning: null,
     session: null,
     phase: 'login',

webapp/src/lib/demo.ts

@@ -790,6 +790,7 @@ export function createDemoInitialBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations: 600000,
     registrationInviteRequired: true,
+    websiteIconsEnabled: true,
     jwtWarning: null,
     session: null,
     phase: 'login',
@@ -1200,7 +1201,7 @@ export function createDemoMainRoutesProps(base: AppMainRoutesProps, notify: Noti
     onDownloadRemoteBackup: async (_masterPassword: string, _destinationId: string, _path: string, _onProgress?: (percent: number | null) => void) => {
       notify('success', t('txt_demo_download_prepared'));
     },
-    onInspectRemoteBackup: async (_destinationId: string, path: string) => ({
+    onInspectRemoteBackup: async (_masterPassword: string, _destinationId: string, path: string) => ({
       object: 'backup-remote-integrity',
       destinationId: _destinationId,
       path,

webapp/src/lib/types.ts

@@ -280,6 +280,8 @@ export interface Send {
   key?: string | null;
   maxAccessCount?: number | null;
   accessCount?: number;
+  password?: string | null;
+  authType?: number | null;
   disabled?: boolean;
   revisionDate?: string;
   expirationDate?: string | null;
@@ -308,6 +310,7 @@ export interface SendDraft {
   expirationDays: string;
   maxAccessCount: string;
   password: string;
+  hasPassword?: boolean;
   disabled: boolean;
 }
 
@@ -411,6 +414,8 @@ export interface WebBootstrapResponse {
   jwtUnsafeReason?: 'missing' | 'too_short' | null;
   jwtSecretMinLength?: number;
   registrationInviteRequired?: boolean;
+  webAuthnAllowedOrigins?: string[];
+  websiteIconsEnabled?: boolean;
 }
 
 export interface YubiKeyOtpSettings {

webapp/src/lib/website-icon-settings.ts

@@ -0,0 +1,9 @@
+let websiteIconsEnabled = true;
+
+export function setWebsiteIconsEnabled(enabled: boolean): void {
+  websiteIconsEnabled = enabled;
+}
+
+export function areWebsiteIconsEnabled(): boolean {
+  return websiteIconsEnabled;
+}

webapp/src/styles/vault.css

@@ -1269,3 +1269,8 @@ select.input.duplicate-mode-toolbar-select {
   @apply text-sm;
   color: var(--danger);
 }
+
+.inline-icon {
+  display: inline;
+  vertical-align: middle;
+}