beeping icon indicating copy to clipboard operation
beeping copied to clipboard

Server auth

Open bcolucci opened this issue 8 years ago • 6 comments

** BASED ON THE BRANCH "removing-gin" ** ** MERGE FIRST "removing-gin" **

  • Add a HTTP Basic Auth (digest) mecanism to secure the BeePing server.
  • Update the readme file.

TODO: Update the dependencies lock (don't know how to do, sorry...)

bcolucci avatar Jul 08 '17 20:07 bcolucci

dep ensure to update your Gopkg

yanc0 avatar Jul 10 '17 10:07 yanc0

Dependencies lock updated.

bcolucci avatar Jul 10 '17 10:07 bcolucci

Thanks Brice!

Here some examples for testing this PR.

digest-test digest2

$ ./beeping -listen "[2002:c000:203::1]" -auth "admin:0821726485a84fcb0d4c90fecf5d40b6"
$ curl -6 '[2002:c000:203::1]:8080/check' -d '{"url": "http://www.nyan.cat/"}' -u "admin:passw0rd" --digest

But digest is a bit complicated if you don't really know how to set correctly Realm or DigestDomain.

This is why I generally implement BasicAuth because it's easier to setup and with a strong password + HTTPS there is no security problem (maybe @insp3ctre can argue on this point).

Also, there is no need for external dependencies, look at this function: https://github.com/yanc0/greedee/blob/master/http.go#L16-L32

Digest is OK for me but I think we have to document (README) how to activate BeePing Auth more precisely with command line only (MacOS and GNU/Linux)?

What do you think guys?

Cheers ! Yann

yanc0 avatar Jul 10 '17 12:07 yanc0

I thought we can add the -auth-method argument. By default it could be "basic", and we could have "digest".

bcolucci avatar Jul 10 '17 13:07 bcolucci

Seems OK for me.

yanc0 avatar Jul 10 '17 14:07 yanc0

Just made some changes. Please do not merge until I add at least md5 digest mechanism :)

bcolucci avatar Jul 10 '17 15:07 bcolucci