rss icon indicating copy to clipboard operation
rss copied to clipboard

Support HTTP basic auth via configuration

Open Bustel opened this issue 4 years ago • 1 comments

Right now if I want to subscribe a room to a private feed I can do so via https://user:[email protected]/rss. This is however, unsatisfying because it exposes my credentials to the whole room.

A better solution would be to utilize aiohttp's basic auth capabilities for certain domains if an RSS admin does the subscription.

Some necessary steps:

  • Check headers['www-authenticate'] in parse_feed for 'Basic realm="Use test/basic"' This indicates that auth is needed
  • Add new configuration item, sth. like:
    private_feeds:
       - url: "*.example.org"
         user: johndoe
         pw: supersecure
    
  • If we have credentials for the url, then self.http.get(url, auth=aiohttp.BasicAuth(user, pass))
  • If a subscription matches a private feed, only an rss-admin should be allowed to manage it

What do you think about such an enhancement? I would consider providing a pull request but i dont have a good dev setup here to test it.

Bustel avatar Feb 22 '21 13:02 Bustel

I would love to have such a feature too!

xrayn avatar May 06 '21 09:05 xrayn