# Vaultwarden Security Hardening: IP Blocking, HTTPS Requirements, and Admin Session Settings

> Learn Vaultwarden security hardening. Implement IP blocking, enforce HTTPS, and configure admin session settings for enhanced protection.

- Repository: [Daniel García/vaultwarden](https://github.com/dani-garcia/vaultwarden)
- Tags: best-practices
- Published: 2026-03-07

---

**Vaultwarden provides configurable security hardening through environment variables and JSON configuration that enforces IP-based request blocking, mandatory HTTPS for external services, and granular admin session controls including rate limiting and JWT lifetime management.**

The open-source Vaultwarden project (dani-garcia/vaultwarden) implements a Bitwarden-compatible server with extensive security knobs that operators can tune to match their threat model. All configuration options are validated at startup in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs), ensuring that misconfigurations abort the server launch rather than create silent security gaps.

## Network and IP Blocking Configuration

Vaultwarden hardens outbound HTTP requests to prevent Server-Side Request Forgery (SSRF) attacks and unauthorized internal network access.

### Blocking Non-Global IP Addresses

The **`http_request_block_non_global_ips`** setting (default `true`) automatically rejects any outbound request to private, link-local, or loopback addresses. This prevents malicious URLs from reaching internal metadata services or internal APIs.

In [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs) at line 1002, this option is defined alongside the deprecated `icon_blacklist_non_global_ips` flag for backward compatibility. The enforcement logic resides in [`src/http_client.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/http_client.rs) (line 158), where requests matching non-global IP ranges are blocked before connection establishment.

### Regex-Based Request Filtering

For finer control, **`http_request_block_regex`** accepts a regular expression that matches hostnames or IPs the internal HTTP client must not contact. This is defined at line 998 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs).

```json
{
  "http_request_block_regex": "^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[0-1])\\.)"
}

```

*Result*: Any outbound HTTP request to IPv4 private ranges is rejected by the HTTP client implementation.

### Forwarded Email Alias Restrictions

The **`allowed_connect_src`** setting (lines 763-764 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)) defines a CSP-style whitelist limiting which external URLs can be loaded by the Forwarded Email Alias feature. The parser at lines 974-975 validates that every entry begins with `https://`, rejecting malformed or insecure origins.

```json
{
  "allowed_connect_src": "https://api.myservice.com"
}

```

If a non-HTTPS URL is supplied, the server aborts with: `ALLOWED_CONNECT_SRC variable contains one or more invalid URLs. Only FQDN's starting with https are allowed`.

## HTTPS Enforcement and Secure Communication

Vaultwarden validates HTTPS requirements during configuration parsing to ensure encrypted communication with external identity and push services.

### Push Notification Service Requirements

The **`push_relay_uri`** and **`push_identity_uri`** settings (lines 1010-1013 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)) must use `https://` schemes. The parser validates the URL format and scheme on startup, defaulting to `https://push.bitwarden.com` and `https://identity.bitwarden.com`.

```bash
export PUSH_RELAY_URI="https://push.mycompany.com"
export PUSH_IDENTITY_URI="https://identity.mycompany.com"

```

If any variable lacks the `https://` prefix, Vaultwarden aborts startup with: `` `PUSH_RELAY_URI` must start with 'https://' ``.

### Yubico Validation Endpoints

The **`yubico_server`** option (lines 1102-1103 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)) requires an HTTPS URL when configuring custom Yubico validation servers. Empty values disable Yubico integration entirely.

### CSP Connect Source Validation

As implemented in the configuration parser, all entries in **`allowed_connect_src`** must be fully-qualified HTTPS origins. This prevents mixed-content vulnerabilities when the vault loads external resources.

## Admin Panel Hardening

Vaultwarden implements layered access controls for the administrative interface, combining token-based authentication, rate limiting, and short-lived session tokens.

### Admin Token Authentication

The **`admin_token`** setting (lines 991-996 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)) stores either a plaintext secret or an Argon2 PHC hash required to access the admin UI. When empty and **`disable_admin_token`** (line 757) is `false`, the admin interface is completely disabled.

```bash
ADMIN_TOKEN="s3cr3t-adm1n-t0k3n"
DISABLE_ADMIN_TOKEN=false

```

**Warning**: Setting `disable_admin_token` to `true` removes token requirements, allowing you to front the admin panel with an external authentication proxy. Only enable this in controlled network environments.

### Rate Limiting for Brute Force Protection

The **`admin_ratelimit_seconds`** and **`admin_ratelimit_max_burst`** options (lines 771-774 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)) configure per-IP rate limiting for admin endpoint access. The defaults are `300` seconds average with a burst size of `3`.

The enforcement implementation in [`src/ratelimit.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/ratelimit.rs) (lines 15-19) instantiates a rate limiter from these config values and applies it to every admin request, preventing brute-force attacks against the login form.

### Session Lifetime Management

**`admin_session_lifetime`** (lines 776-777 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)) controls the JWT expiration time in minutes for authenticated admin sessions. The default is `20` minutes, with shorter windows reducing compromise exposure.

The JWT generation in [`src/auth.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/auth.rs) (line 481) respects this lifetime when issuing tokens. When the session expires, administrators must re-authenticate with the token.

```toml
ADMIN_SESSION_LIFETIME=15

```

## Content Security and Iframe Restrictions

Vaultwarden provides Content Security Policy (CSP) controls to prevent clickjacking and unauthorized resource loading.

### Controlling Iframe Embedding

**`allowed_iframe_ancestors`** (lines 760-762 in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)) restricts which origins may embed the web vault in an iframe. This is injected into CSP headers by the helper functions in [`src/util.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/util.rs) (line 53).

```json
{
  "allowed_iframe_ancestors": "https://intranet.example.com"
}

```

Empty values (default) prevent all iframe embedding, mitigating clickjacking risks.

### Icon Service Configuration

The **`icon_service`** setting determines how external favicon fetches are handled. Setting this to `internal` disables outgoing HTTP calls for icons, reducing the attack surface for SSRF via malicious website URLs stored in vault items.

## Summary

- **IP blocking** is enforced through `http_request_block_non_global_ips` (default enabled) and regex-based filtering in [`src/http_client.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/http_client.rs)
- **HTTPS requirements** are mandatory for `push_relay_uri`, `push_identity_uri`, `yubico_server`, and `allowed_connect_src`, with validation occurring at startup in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs)
- **Admin hardening** combines `admin_token` (or Argon2 hashes), configurable rate limiting (`admin_ratelimit_seconds`/`admin_ratelimit_max_burst`), and short JWT lifetimes (`admin_session_lifetime` defaulting to 20 minutes)
- **CSP controls** via `allowed_iframe_ancestors` and `allowed_connect_src` prevent unauthorized embedding and resource loading

## Frequently Asked Questions

### How do I prevent Vaultwarden from accessing internal network resources?

Enable `http_request_block_non_global_ips` (enabled by default) and optionally configure `http_request_block_regex` with specific IP ranges or hostnames. The enforcement occurs in [`src/http_client.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/http_client.rs) at line 158, which validates every outbound request against these rules before connection establishment.

### What happens if I configure a non-HTTPS URL for push notifications?

Vaultwarden aborts startup with a configuration error. The parser at [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs) lines 1010-1013 validates that `PUSH_RELAY_URI` and `PUSH_IDENTITY_URI` start with `https://`, ensuring encrypted communication with push services. This validation prevents accidental exposure of authentication tokens over plaintext HTTP.

### Can I disable the admin token for proxy-based authentication?

Yes, by setting `disable_admin_token` to `true` in [`src/config.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs) (line 757). This removes the token requirement, allowing you to authenticate administrators through a reverse proxy like Authelia or Authentik. **Only use this in controlled environments** where the admin endpoint is not exposed to untrusted networks, as it bypasses Vaultwarden's native authentication layer.

### How is the admin session timeout controlled?

The `admin_session_lifetime` setting (default 20 minutes) defines the JWT expiration for admin sessions. Implemented in [`src/auth.rs`](https://github.com/dani-garcia/vaultwarden/blob/main/src/auth.rs) at line 481, this setting determines how long an authenticated admin session remains valid before requiring re-authentication. Reduce this value to minimize the window of compromise if a session token is intercepted.