coop-cloud/vaultwarden
3
1
Fork 4
Code Issues 2 Pull Requests 1 Projects Releases Wiki Activity

plain text admin_token is considered insecure #5

New Issue
Closed
opened 2025-03-28 19:38:24 +00:00 by fauno · 5 comments
fauno commented 2025-03-28 19:38:24 +00:00
Owner
Copy Link
Copy Source

https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token

d2025-03-28T19:36:16.999666703Z [NOTICE] You are using a plain text `ADMIN_TOKEN` which is insecure.
s2025-03-28T19:36:16.999863094Z Please generate a secure Argon2 PHC string by using `vaultwarden hash` or `argon2`.
2025-03-28T19:36:17.000027003Z See: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token
https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token ``` d2025-03-28T19:36:16.999666703Z [NOTICE] You are using a plain text `ADMIN_TOKEN` which is insecure. s2025-03-28T19:36:16.999863094Z Please generate a secure Argon2 PHC string by using `vaultwarden hash` or `argon2`. 2025-03-28T19:36:17.000027003Z See: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token ```
👀 1
decentral1se commented 2025-04-24 08:13:29 +00:00
Owner
Copy Link
Copy Source

I didn't have time to check but I assume the migration step is to:

  1. Export your password in plain text
  2. Hash it with the hash command (?)
  3. Re-insert it?

We could add this as documentation in the README.md.

I didn't have time to check but I assume the migration step is to: 1. Export your password in plain text 2. Hash it with the `hash` command (?) 3. Re-insert it? We could add this as documentation in the `README.md`.
fauno commented 2025-04-24 14:39:13 +00:00
Author
Owner
Copy Link
Copy Source

you can also do it from the admin web ui, that's what i did finally. the secret should be hashed anyway, so the issue is with autogenerated secrets (unless abra can be told to hash secrets! a wild feature request appears!)

you can also do it from the admin web ui, that's what i did finally. the secret should be hashed anyway, so the issue is with autogenerated secrets (unless abra can be told to hash secrets! a wild feature request appears!)
👍 1
decentral1se commented 2025-04-24 19:28:41 +00:00
Owner
Copy Link
Copy Source

The logic is there but I'm not sure adding the dependency just for this specific use case is really worth it? Are there other apps that require it? If you fee like we should go for it, feel free to open an issue for abra.

I guess just docs in the README.md to close this one then here.

[The logic](https://docs.coopcloud.tech/maintainers/handbook/#how-do-i-change-secret-generation-characters) is there but I'm not sure adding the dependency just for this specific use case is really worth it? Are there other apps that require it? If you fee like we should go for it, feel free to open an issue for `abra`. I guess just docs in the `README.md` to close this one then here.
ammaratef45 commented 2026-03-09 02:41:58 +00:00
Owner
Copy Link
Copy Source

@fauno the readme already points out this as a step

vaultwarden/README.md Line 24 in 01b64fce3d
5. `abra app cmd -l YOURAPPDOMAIN insert_vaultwarden_admin_token` will insert a hashed `admin_token` as password as recommended by vaultwarden. Will echo the admin_token to your cli.

maybe we can close the issue for now until abra supports doing that using app secret generate?

@fauno the readme already points out this as a step https://git.coopcloud.tech/coop-cloud/vaultwarden/src/commit/01b64fce3dd32ac6b1af001d2bea924af86b4a55/README.md?display=source#L24 maybe we can close the issue for now until abra supports doing that using `app secret generate`?
fauno commented 2026-03-10 14:40:55 +00:00
Author
Owner
Copy Link
Copy Source

i'm never sure in which context abra.sh commands run :P

i'm never sure in which context abra.sh commands run :P
😆 1
fauno closed this issue 2026-03-10 14:40:55 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
3wordchant aadil (Aadil Ayub) abra-bot (Abra Bot) ammaratef45 amras (Sarma) Apfelwurm appletalk arjan basebuilder BornDeleuze Brooke carla cas (Cassowary) codegod100 coopcloud cyrnel decentral1se (decentral1se) dede devydave fauno (fauno) flancian Frando iexos jade (Jade Ambrose) javielico (Javielico) jjsfunhouse jmakdah2 joe-irving kawaiipunk (KawaiiPunk) knoflook kolaente lambdabundesverband linnealovespie marlon (marlon) mayel mirsal moosemower moritz nicksellen notplants oxaliq (sorrel) p4u1 pau pharaohgraphy (Andrew 🐦‍🔥❤️‍🔥✴️) PhiNatalie renovate-bot (Comrade Renovate Bot) ripclap rix rscmbbng sef (sef) simon sixsmith (Sixsmith) stevensting tobias trav val (val (he/him)) vaznasty virtualboys wolcen (Chris Thompson) wykwit xynosis yksflip
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coop-cloud/vaultwarden#5
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?