rss
rss copied to clipboard
Support HTTP basic auth via configuration
Right now if I want to subscribe a room to a private feed I can do so via https://user:[email protected]/rss
. This is however, unsatisfying because it exposes my credentials to the whole room.
A better solution would be to utilize aiohttp's basic auth capabilities for certain domains if an RSS admin does the subscription.
Some necessary steps:
- Check
headers['www-authenticate']
inparse_feed
for'Basic realm="Use test/basic"'
This indicates that auth is needed - Add new configuration item, sth. like:
private_feeds: - url: "*.example.org" user: johndoe pw: supersecure
- If we have credentials for the url, then
self.http.get(url, auth=aiohttp.BasicAuth(user, pass))
- If a subscription matches a private feed, only an rss-admin should be allowed to manage it
What do you think about such an enhancement? I would consider providing a pull request but i dont have a good dev setup here to test it.
I would love to have such a feature too!