From ef96e4e2f5c62749126892f5652089bf10c1bc14 Mon Sep 17 00:00:00 2001 From: Stefan Melmuk <509385+stefan0xC@users.noreply.github.com> Date: Tue, 20 Jan 2026 19:05:52 +0000 Subject: [PATCH] small typos --- Enabling-admin-page.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Enabling-admin-page.md b/Enabling-admin-page.md index cfceae9..88c35a7 100644 --- a/Enabling-admin-page.md +++ b/Enabling-admin-page.md @@ -7,7 +7,7 @@ The Vaultwarden Admin panel allows a server administrator to configure Vaultward ## How to enable the Admin page -To enable the admin page you probably to configure an authentication token. This token can be anything but it's recommended to use a long, randomly generated string of characters. For example by running `openssl rand -base64 48`. +To enable the admin page you need to configure an authentication token. This token can be anything but it's recommended to use a long, randomly generated string of characters. For example by running `openssl rand -base64 48`. **Keep this token a secret. If you configure this as the `ADMIN_TOKEN` this will be used as the password to access the admin area of your server!** Since the configuration is generally stored in plain text, it is recommended to [secure the admin token](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token). @@ -17,7 +17,7 @@ You can also enable the admin panel by [disabling the need to use an admin token If you enter the password for the `ADMIN_TOKEN` you will get a JSON Web Token (JWT) that authorizes you to use the `/admin` panel. By default the admin session length is [set to 20 minutes](https://github.com/dani-garcia/vaultwarden/blob/0c6817cb4e24964deaf765fd676da6c49e47d099/src/config.rs#L776-L777). You can configure the session length by changing `ADMIN_SESSION_LIFETIME`. -Due to the nature of JWTs and because there is no additional session handling for the Admin panel, anyone that has a valid JWT will be able to use the stored token to access the Vaultwarden Admin page. Changing the session lifetime or even the admin token itself won't affect currently logged in users, so you should avoid increasing the admin session length unnecessarily. +Due to the nature of JWTs and because there is no additional session handling for the Admin panel, anyone that has a valid JWT will be able to use the stored token to access the Vaultwarden Admin page. Changing the session lifetime or even the admin token itself won't affect currently logged in users so you should avoid increasing the admin session length unnecessarily. To invalidate any session you can remove the [`rsa_key.pem`](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault#the-rsa_key-files) from the `DATA_FOLDER` and restart Vaultwarden for the RSA key to be recreated. @@ -75,7 +75,7 @@ If you have configured your Vaultwarden via the `/admin` page, you should paste After you set the PHC string, you can login by using the password you have used to generate the PHC string, e.g. `MySecretPassword` in the example above to login. > [!NOTE] -If you can enter the whole `$argon2id$…` PHC string as an admin password you are probably using an outdated version of Vaultwarden that does not support argon2id yet. Make sure you are using at least the latest version. +If you can enter the whole `$argon2id$…` PHC string as an admin password you are probably using an outdated version of Vaultwarden that does not support argon2id yet. Make sure you are using at least the [latest version](https://github.com/dani-garcia/vaultwarden/releases/latest). ### How to prevent variable interpolation in `docker-compose.yml` @@ -133,7 +133,7 @@ You can check your configuration by calling `docker compose config`, you should ### Troubleshooting tips -If you keep getting the message `You are using a plain text ADMIN_TOKEN which is insecure.`, then you either have saved the configuration via the admin interface already and environment variables will not be used (see [configuration precedence](https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview#configuration-precedence)). Or you need to verify if you used the correct format. +If you keep getting the message `You are using a plain text ADMIN_TOKEN which is insecure.` then you either have saved the configuration via the admin interface already and environment variables will not be used (see [configuration precedence](https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview#configuration-precedence)). Or you need to verify if you used the correct format. You need to make sure that the configured PHC string is correctly passed to Vaultwarden so that the actual value does not end up with unneeded quotation marks like `'` or `"` around them and also that the dollar signs are not doubled `$$argon2id$$v=19$$m=65540…`.