The vault.bitwarden.com website exposes the access_token in the notification's web socket request

[l1ttps]

Steps To Reproduce

1. Go to 'vault.bitwarden.com'
2. Open developer console
3. Open Network
4. View detail wss://notifications.bitwarden.com/hub?access_token=eyJhbGciOiJSUzI1NiIsImt in ws request
5. Copy JWT token from URL as search query
6. Paste jwt.io
7. View full profile in payload token of user

Expected Result

Use another way to transmit the access_token to the server

Actual Result

Token leak

Screenshots or Videos

Additional Context

No response

Build Version

Web https://vault.bitwarden.com/

Environment

Cloud (bitwarden.com)

Environment Details

No response

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[ainola]

Hi, @l1ttps, thanks for working on this. Is there an associated PR or some other work we can look at since this is marked as "completed"?