Vaultwarden Security Hardening: IP Blocking, HTTPS Requirements, and Admin Session Settings

Vaultwarden provides configurable security hardening through environment variables and JSON configuration that enforces IP-based request blocking, mandatory HTTPS for external services, and granular admin session controls including rate limiting and JWT lifetime management.

The open-source Vaultwarden project (dani-garcia/vaultwarden) implements a Bitwarden-compatible server with extensive security knobs that operators can tune to match their threat model. All configuration options are validated at startup in src/config.rs, ensuring that misconfigurations abort the server launch rather than create silent security gaps.

Network and IP Blocking Configuration

Vaultwarden hardens outbound HTTP requests to prevent Server-Side Request Forgery (SSRF) attacks and unauthorized internal network access.

Blocking Non-Global IP Addresses

The http_request_block_non_global_ips setting (default true) automatically rejects any outbound request to private, link-local, or loopback addresses. This prevents malicious URLs from reaching internal metadata services or internal APIs.

In src/config.rs at line 1002, this option is defined alongside the deprecated icon_blacklist_non_global_ips flag for backward compatibility. The enforcement logic resides in src/http_client.rs (line 158), where requests matching non-global IP ranges are blocked before connection establishment.

Regex-Based Request Filtering

For finer control, http_request_block_regex accepts a regular expression that matches hostnames or IPs the internal HTTP client must not contact. This is defined at line 998 in src/config.rs.

{
  "http_request_block_regex": "^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[0-1])\\.)"
}

Result: Any outbound HTTP request to IPv4 private ranges is rejected by the HTTP client implementation.

Forwarded Email Alias Restrictions

The allowed_connect_src setting (lines 763-764 in src/config.rs) defines a CSP-style whitelist limiting which external URLs can be loaded by the Forwarded Email Alias feature. The parser at lines 974-975 validates that every entry begins with https://, rejecting malformed or insecure origins.

{
  "allowed_connect_src": "https://api.myservice.com"
}

If a non-HTTPS URL is supplied, the server aborts with: ALLOWED_CONNECT_SRC variable contains one or more invalid URLs. Only FQDN's starting with https are allowed.

HTTPS Enforcement and Secure Communication

Vaultwarden validates HTTPS requirements during configuration parsing to ensure encrypted communication with external identity and push services.

Push Notification Service Requirements

The push_relay_uri and push_identity_uri settings (lines 1010-1013 in src/config.rs) must use https:// schemes. The parser validates the URL format and scheme on startup, defaulting to https://push.bitwarden.com and https://identity.bitwarden.com.

export PUSH_RELAY_URI="https://push.mycompany.com"
export PUSH_IDENTITY_URI="https://identity.mycompany.com"

If any variable lacks the https:// prefix, Vaultwarden aborts startup with: `PUSH_RELAY_URI` must start with 'https://'.

Yubico Validation Endpoints

The yubico_server option (lines 1102-1103 in src/config.rs) requires an HTTPS URL when configuring custom Yubico validation servers. Empty values disable Yubico integration entirely.

CSP Connect Source Validation

As implemented in the configuration parser, all entries in allowed_connect_src must be fully-qualified HTTPS origins. This prevents mixed-content vulnerabilities when the vault loads external resources.

Admin Panel Hardening

Vaultwarden implements layered access controls for the administrative interface, combining token-based authentication, rate limiting, and short-lived session tokens.

Admin Token Authentication

The admin_token setting (lines 991-996 in src/config.rs) stores either a plaintext secret or an Argon2 PHC hash required to access the admin UI. When empty and disable_admin_token (line 757) is false, the admin interface is completely disabled.

ADMIN_TOKEN="s3cr3t-adm1n-t0k3n"
DISABLE_ADMIN_TOKEN=false

Warning: Setting disable_admin_token to true removes token requirements, allowing you to front the admin panel with an external authentication proxy. Only enable this in controlled network environments.

Rate Limiting for Brute Force Protection

The admin_ratelimit_seconds and admin_ratelimit_max_burst options (lines 771-774 in src/config.rs) configure per-IP rate limiting for admin endpoint access. The defaults are 300 seconds average with a burst size of 3.

The enforcement implementation in src/ratelimit.rs (lines 15-19) instantiates a rate limiter from these config values and applies it to every admin request, preventing brute-force attacks against the login form.

Session Lifetime Management

admin_session_lifetime (lines 776-777 in src/config.rs) controls the JWT expiration time in minutes for authenticated admin sessions. The default is 20 minutes, with shorter windows reducing compromise exposure.

The JWT generation in src/auth.rs (line 481) respects this lifetime when issuing tokens. When the session expires, administrators must re-authenticate with the token.

ADMIN_SESSION_LIFETIME=15

Content Security and Iframe Restrictions

Vaultwarden provides Content Security Policy (CSP) controls to prevent clickjacking and unauthorized resource loading.

Controlling Iframe Embedding

allowed_iframe_ancestors (lines 760-762 in src/config.rs) restricts which origins may embed the web vault in an iframe. This is injected into CSP headers by the helper functions in src/util.rs (line 53).

{
  "allowed_iframe_ancestors": "https://intranet.example.com"
}

Empty values (default) prevent all iframe embedding, mitigating clickjacking risks.

Icon Service Configuration

The icon_service setting determines how external favicon fetches are handled. Setting this to internal disables outgoing HTTP calls for icons, reducing the attack surface for SSRF via malicious website URLs stored in vault items.

Summary

• IP blocking is enforced through http_request_block_non_global_ips (default enabled) and regex-based filtering in src/http_client.rs
• HTTPS requirements are mandatory for push_relay_uri, push_identity_uri, yubico_server, and allowed_connect_src, with validation occurring at startup in src/config.rs
• Admin hardening combines admin_token (or Argon2 hashes), configurable rate limiting (admin_ratelimit_seconds/admin_ratelimit_max_burst), and short JWT lifetimes (admin_session_lifetime defaulting to 20 minutes)
• CSP controls via allowed_iframe_ancestors and allowed_connect_src prevent unauthorized embedding and resource loading

Frequently Asked Questions

How do I prevent Vaultwarden from accessing internal network resources?

Enable http_request_block_non_global_ips (enabled by default) and optionally configure http_request_block_regex with specific IP ranges or hostnames. The enforcement occurs in src/http_client.rs at line 158, which validates every outbound request against these rules before connection establishment.

What happens if I configure a non-HTTPS URL for push notifications?

Vaultwarden aborts startup with a configuration error. The parser at src/config.rs lines 1010-1013 validates that PUSH_RELAY_URI and PUSH_IDENTITY_URI start with https://, ensuring encrypted communication with push services. This validation prevents accidental exposure of authentication tokens over plaintext HTTP.

Can I disable the admin token for proxy-based authentication?

Yes, by setting disable_admin_token to true in src/config.rs (line 757). This removes the token requirement, allowing you to authenticate administrators through a reverse proxy like Authelia or Authentik. Only use this in controlled environments where the admin endpoint is not exposed to untrusted networks, as it bypasses Vaultwarden's native authentication layer.

How is the admin session timeout controlled?

The admin_session_lifetime setting (default 20 minutes) defines the JWT expiration for admin sessions. Implemented in src/auth.rs at line 481, this setting determines how long an authenticated admin session remains valid before requiring re-authentication. Reduce this value to minimize the window of compromise if a session token is intercepted.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}