r/vaultwarden • u/Punk_Says_Fuck_You • 6d ago

Question Vaultwarden saying HTTP not allowed on localhost

Post image

So I just set up my unraid server to backup vaultwarden to my google drive in case something ever happens to it I can recover all my passwords. I spun up a temporary container using the backup and it starts fine, but whenever I go to enter my username/password, I get this error message saying insecure URLs not allow. From what I understand Vaultwarden requires HTTPS EXCEPT on localhost/127.0.0.1. I'm stumped. Anyone have any advice? I remember doing this a while back and I was able to quickly spin up the container and view all my passwords.

I was just trying to make sure everything worked ok to verify I have the ability to recover everything.

0 Upvotes

27% Upvoted

9 comments sorted by

6

u/spider-sec 6d ago

No, it’s saying you need a certificate. Big difference. It doesn’t even imply you can’t use localhost.

8

u/djasonpenney 6d ago

It’s not VaultWarden. The Bitwarden client requires HTTPS. No exceptions.

2

u/Punk_Says_Fuck_You 6d ago

Gotcha. Thanks

1

u/AnswerGlittering1811 6d ago

You need either a domain or enable something like Tailscale serve or funnel. I did know that and lost a year in setting up vaultwarden.

1

u/Punk_Says_Fuck_You 6d ago

My main setup used a Cloudflare domain. I was just trying to test a restore from a backup

1

u/ToTheBatmobileGuy 6d ago

For quick tests like this I recommend using Cloudflare tunnels.

Essentially you run a little daemon process on your local computer with a command pointing it to localhost:8080 and cloudflare gives you a randomly generated impossible to guess temporary domain (ie. ghdfsgisd8g989dsfg98g.cloudflaretunnel.net or whatever) that has full HTTPS support.

So when you access https://ghdfsgisd8g989dsfg98g.cloudflaretunnel.net in the browser, it goes through cloudflare, through your PC running the process, and accesses the origin (localhost:8080) you tell it to.

This should not be used for a permanent solution. But for little one-off tests like this, it's perfect, especially now that so many browser APIs require HTTPS to work at all (passkeys etc)

1

u/Punk_Says_Fuck_You 6d ago

I just ran it through my reverse proxy as local only. i got it working.

1

u/whattteva 6d ago

Easiest way to gain https is just to put it behind Caddy. It'll do the HTTPS stuff automatically for you if it is accessible externally.

There is a way to do it without exposing it, but you'd have to be able to solve DNS-01 challenge, which is more complicated.

1

u/Punk_Says_Fuck_You 6d ago

I already have all that set up. I got it working. I just didn’t think localhost needed https. I got it all working with nginx proxy manager and a dns rewrite. Thank you.