SIGNUPS_ALLOWED=false not working anymore

[gjibrane]

Vaultwarden Support String

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.33.2
• Web-vault version: v2025.1.1
• OS/Arch: linux/x86_64
• Running within a container: false (Base: Not applicable)
• Database type: PostgreSQL
• Database version: PostgreSQL 13.18 on x86_64-redhat-linux-gnu, compiled by gcc (GCC) 11.5.0 20240719 (Red Hat 11.5.0-2.0.1), 64-bit
• Environment settings overridden!: false
• Uses a reverse proxy: true
• IP Header check: true (X-Real-IP)
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• Browser/Server Time Check: true
• Server/NTP Time Check: true
• Domain Configuration Check: true
• HTTPS Check: true
• Websocket Check: true
• HTTP Response Checks: false

Config & Details (Generated via diagnostics page)

Show Config & Details

Failed HTTP Checks:

2FA Connector calls:
Header: 'cross-origin-resource-policy' is missing!

Config:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "**********://***************************************************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://**************",
  "domain_origin": "*****://**************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": false,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "fido2-vault-credentials",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 600,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": false,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "*****************",
  "org_events_enabled": false,
  "org_groups_enabled": true,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "push_enabled": true,
  "push_identity_uri": "https://identity.bitwarden.eu",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.eu",
  "reload_templates": false,
  "require_device_email": true,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "*******",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "**************",
  "smtp_from_name": "Coffre ANFH",
  "smtp_host": "********************",
  "smtp_password": null,
  "smtp_port": 6025,
  "smtp_security": "off",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": null,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": 60,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "/usr/share/vaultwarden-web",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

v1.33.2

Deployment method

OS Package (apt, yum/dnf, pacman, apk, nix, ...)

Custom deployment method

No response

Reverse Proxy

Netscaler ADC NS13.1 55.34.nc

Host/Server Operating System

Linux

Operating System Version

Oracle Linux 9.5

Clients

Web Vault

Client Version

Chrome Version 134.0.6998.178 (Build officiel) (64 bits)

Steps To Reproduce

1. Go to 'vaut.mycorp.tld'
2. See 'Create Account'

Expected Result

Shouldn't be there and working.
Behavour changed after update from 1.32.7

Actual Result

Disabling register with SIGNUPS_ALLOWED=false doesn't work anymore.

Logs

Screenshots or Videos

No response

Additional Context

No response

[BlackDex]

You have signups_domains_whitelist configured.

[gjibrane]

I commented the parameter and it doesn't change anything.
Create account is still there.

[BlackDex]

Did you tried to actually create an account? And does that work? Because that probably will not.

[gjibrane]

This is worst you can fill the form and when you validate it says user already exists or ....
I just want to hide back the link "create account".
May be I have now to modify the web page.

[BlackDex]

If you configure everything correctly it should be hidden.
But you can always hide it permanently via https://github.com/dani-garcia/vaultwarden/wiki/Customize-Vaultwarden-CSS

[gjibrane]

It was hidden before update, and showed up without changing parameters.

What is the correct settings ?

[Lychee-acaca]

I checked the code and found that the current logic in is_signup_disabled() makes the "Create Account" button still show when SIGNUPS_ALLOWED=false and mail is disabled but invitations are allowed. This seems to be the default behavior according to the current implementation. Then I tried to set INVITATIONS_ALLOWED=false and the button disappeared.

This doesn’t match what the wiki says:

Note that when SIGNUPS_ALLOWED=false, the Create Account button will not be shown in the web vault UI. Invitation is still possible regardless of this settings.

Code here:

vaultwarden/src/config.rs

Lines 1438 to 1443 in 8e7eeab

	pub fn is_signup_disabled(&self) -> bool {
	(!self.signups_allowed()
	&& self.signups_domains_whitelist().is_empty()
	&& (self.mail_enabled() || !self.invitations_allowed()))
	|| (self.sso_enabled() && self.sso_only())
	}

So maybe the wiki needs to mention this case, or the code should hide the button in this scenario.

[stefan0xC]

The wiki has not been updated. Cf. #6109

[stefan0xC]

I've updated the wiki.