Security
Configure local login, managed users, two-factor authentication, external sign-in, and trusted reverse proxies.
Use this page to control who can sign in and how CW handles sessions.
Local login
Username
Set the local CW admin username used on the login page.
New password
Set a new local CW password.
Leave this blank to keep the current password
Minimum length:
8
Confirm password
Repeat the new password exactly.
CW will not save if the password fields do not match.
User Manager
Use User Manager to create and manage managed-user login accounts.
The administrator account always appears here. It has access to the complete CrossWatch installation. It is not restricted to a User Profile.
Managed users require a User Profile. A User Profile defines the resources delegated to an account.
Create provider instances and synchronization resources before creating the account.
When no User Profiles exist, create one before adding a managed user.
Create and change users
Each managed user requires a username, password, User Profile, and access mode.
User Manager can change a managed user's:
Username or password
Assigned User Profile
Read Only or Full Access access mode
Enabled or disabled state
Changing the User Profile changes the account's resource scope. Changing access mode changes what the account may do within that scope.
Disable an account to prevent sign-in without removing its profile or resources. Deleting an account removes only its login. It does not delete delegated provider instances, pairs, Watchers, or Webhooks.
See Managed users for the delegation model and setup workflow.
Two-factor authentication
Two-factor authentication (2FA) adds a six-digit authenticator-code prompt to an account.
The administrator configures it for the administrator and managed-user accounts.
2FA protects account authentication. It does not change the User Profile or Access Mode.
Related: Two-factor authentication.
Session
Session caching
Choose how long the login session lasts.
Enabled— keeps you signed in for the number of days you chooseBrowser session only— signs you out when the browser fully closes
This only affects the CW web session.
It does not change provider tokens.
Cached for days
Set how long a remembered session stays valid.
Only used when
Session cachingis enabledRange:
1to365
External sign-in
Plex and OIDC sign-in are optional.
They add an external sign-in option to the login page.
Your local CW username and password stay as the fallback sign-in method.
Plex
Link Plex account — link one Plex account for web sign-in
Unlink — remove Plex sign-in from the login page
Related: Plex SSO.
OIDC
OIDC authenticates CrossWatch accounts through an OpenID Connect provider.
Configure the provider once, then link an identity to each CrossWatch account.
Related: OIDC sign-in.
Current session
This section shows the browser session you are currently using to access CW. If your account has other active browser sessions, CW shows those separately so it is clear which session is current and which sessions are not.
Log out
Use Log out to end only the session for the browser you are using right now.
Other active sessions
If the same account is signed in from other browsers or devices, CW shows a compact summary of those sessions here.
Log out other sessions
Use Log out other sessions to sign out every other active browser session while keeping your current browser signed in. This is useful when you want to remove stale, duplicate, or forgotten logins without signing yourself out.
Reverse proxy
Trusted reverse proxies (optional)
Use this only when CW sits behind a reverse proxy and you want correct client IP handling for login protection and rate limiting.
Enter proxy IP addresses or CIDR ranges separated by ;.
Example:
Add the proxy server IPs here.
Do not add the IPs of end users connecting through the proxy.
Last updated
Was this helpful?