Wrong domain URL in general settings break the admin panel #1262

New Issue

OVERLORD · 2026-02-05T00:24:20+03:00

OVERLORD commented

2026-02-05 00:24:20 +03:00

Originally created by @mh4ckt3mh4ckt1c4s on GitHub (Apr 30, 2022).

Subject of the issue

When using a wrong value in the URL Domain parameter of the General settings of the admin panel, saving this parameter break the admin panel. The CSS and images are not loaded anymore, and the parameters can't be changed (saving is resulting to an unknown error). Also, you will never be able to log in the admin panel again once you logged out after this bug.

Deployment environment

Vaultwarden version: v1.24.0
Web-vault version: v2.25.1
Running within Docker: true (Base: Debian)
Clients used: Web client
MySQL/MariaDB or PostgreSQL version: SQLite 3.35.4

Steps to reproduce

start an instance of the server with admin panel enabled : sudo docker run vaultwarden/server -e ADMIN_TOKEN=1234
Access to the admin interface and enter the token
Change the URL Domain in the General settings to an invalid value (eg. http://mydomain/com)

Expected behaviour

The invalid URL is signaled and the parameters are not saved. Also, the page is not breaking.

Actual behaviour

The parameter is saved, effectively breaking the admin panel as described before.

Troubleshooting data

It seems that it is the / character that is breaking the panel. However, it should be investigated if other characters / patterns can also make the panel break.

Originally created by @mh4ckt3mh4ckt1c4s on GitHub (Apr 30, 2022).   ### Subject of the issue  When using a wrong value in the URL Domain parameter of the General settings of the admin panel, saving this parameter break the admin panel. The CSS and images are not loaded anymore, and the parameters can't be changed (saving is resulting to an unknown error). Also, you will never be able to log in the admin panel again once you logged out after this bug. ### Deployment environment     * Vaultwarden version: v1.24.0 * Web-vault version: v2.25.1 * Running within Docker: true (Base: Debian) * Clients used: Web client  * MySQL/MariaDB or PostgreSQL version: SQLite 3.35.4 ### Steps to reproduce  * start an instance of the server with admin panel enabled : `sudo docker run vaultwarden/server -e ADMIN_TOKEN=1234` * Access to the admin interface and enter the token * Change the URL Domain in the General settings to an invalid value (eg. `http://mydomain/com`) ### Expected behaviour  The invalid URL is signaled and the parameters are not saved. Also, the page is not breaking. ### Actual behaviour  The parameter is saved, effectively breaking the admin panel as described before. ### Troubleshooting data  It seems that it is the / character that is breaking the panel. However, it should be investigated if other characters / patterns can also make the panel break.

OVERLORD closed this issue

2026-02-05 00:24:21 +03:00

OVERLORD commented

2026-02-05 00:24:24 +03:00

@BlackDex commented on GitHub (Apr 30, 2022):

That is expected behavior since we support running Vaultwarden under a sub-path also instead of only a sub-domain.
The DOMAIN variable is used to ensure all the links are pointing to the correct endpoint.

Not having the correct DOMAIN variable set could leads to issues with attachments, sends, but also the admin as you have experienced.

You should still be able to access the admin interface though, although no styling is shown, the javascript part still works and you should be able to fix this by searching for DOMAIN and change it back to what it was. That should fix it, or you need to fix it manually by editing the config.json file within your data folder.

We can't go and try to detect a / in there, since we do support that. And we can't really detect if you make a mistake or not.

@BlackDex commented on GitHub (Apr 30, 2022): That is expected behavior since we support running Vaultwarden under a sub-path also instead of only a sub-domain. The `DOMAIN` variable is used to ensure all the links are pointing to the correct endpoint. Not having the correct `DOMAIN` variable set could leads to issues with attachments, sends, but also the admin as you have experienced. You should still be able to access the admin interface though, although no styling is shown, the javascript part still works and you should be able to fix this by searching for `DOMAIN` and change it back to what it was. That should fix it, or you need to fix it manually by editing the `config.json` file within your data folder. We can't go and try to detect a `/` in there, since we do support that. And we can't really detect if you make a mistake or not.

OVERLORD referenced this issue

2026-02-05 05:02:52 +03:00

[PR #1262] [MERGED] Updated icon downloading. #2903

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#1262