Reverse Proxy + Rocket SSL

[Andrej553-2]

Greetings,

i plan to use Vaultwarden for a small company.
My test setup is up and running via a reverse proxy as it is recommended.

Is my guess correct, that this kind of setup has security issues because the master password is transmitted unencrypted between proxy -> vaultwarden?
A corrupt admin or hacker could sniff for those logins. So it is advised to run both - a reverse proxy and the "build in" rocket ssl?

[BlackDex]

The password is never sent unencrypted. It's hashed by the clients before it is sent to the server.
Then Vaultwarden stores this hashed password in the databases by first hashing it again, currently using PBKDF2 600.000.

The only password which is sent unencrypted is the Vaultwarden Admin backend (/admin) password, but any sys-admin can adjust that anyway.

If you want to rule-out any mitm between the reverse proxy and Vaultwarden, you could add a self-signed cert which lives very long to Vaultwarden, and configure the reverse proxy to accept that cert and connect to Vaultwarden via SSL.

[Andrej553-2]

Thanks for your quick reply.
If the users use the web-vault is it still encrypted? If not i am fine with running another cert for vaultwarden itself.

[BlackDex]

All clients send it encrypted, else we wouldn't be able to match it.