mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-03-01 11:19:52 +03:00
config.json -- storing plain text? #416
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @moranbw on GitHub (Sep 12, 2019).
Does it matter that we are storing the admin_token and smtp_password as plain text in the config.json? Should the permissions of this file be by default more restrictive?
More asking then suggesting. I guess this still does not necessarily expose a user's vault, which is the main thing.
@mprasil commented on GitHub (Sep 13, 2019):
You can set the permissions of the file yourself - as long as the container user can read and write to it, it should work fine.
You can also provide these as environment variables and you can the work out yourself how to set them in secure manner.
@mprasil commented on GitHub (Sep 30, 2019):
I'm going to close this one as there are multiple ways to provide the credentials without storing them in config.json and the permissions on the file itself can be set in any way as long as the service can read it and write to it. Feel free to reopen, if there's anything more we can do regarding this.