diff --git a/Disable-registration-of-new-users.md b/Disable-registration-of-new-users.md index f4a73e6..1d6b641 100644 --- a/Disable-registration-of-new-users.md +++ b/Disable-registration-of-new-users.md @@ -19,7 +19,9 @@ You can restrict registration to email addresses from certain domains by setting * `SIGNUPS_DOMAINS_WHITELIST=example.com` (single domain) * `SIGNUPS_DOMAINS_WHITELIST=example.com,example.net,example.org` (multiple domains) -If `SIGNUPS_DOMAINS_WHITELIST` is set, then the value of `SIGNUPS_ALLOWED` is ignored. Also, see [#728](https://github.com/dani-garcia/bitwarden_rs/pull/728) for caveats -- in particular, the emails are currently not checked, meaning that anyone could still register, by providing a fake email address that has the proper domain. +If `SIGNUPS_DOMAINS_WHITELIST` is set, then the value of `SIGNUPS_ALLOWED` is ignored. + +You may also want to set `SIGNUPS_VERIFY=true`, which would require email verification before a newly-registered user can successfully log in. This would prevent someone from registering with a fake email address that has the proper domain. ## Invitations via the admin page