Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Only require RPC password when actually viewing RPC routes #210

Open
adamgall opened this issue May 13, 2020 · 3 comments · May be fixed by #211
Open

Only require RPC password when actually viewing RPC routes #210

adamgall opened this issue May 13, 2020 · 3 comments · May be fixed by #211

Comments

@adamgall
Copy link

Currently, when the app is configured with BTCEXP_BASIC_AUTH_PASSWORD, the Basic Auth popup is displayed as soon as the site loads.

In my opinion, the Basic Auth popup should only be displayed when the user attempts to GET/POST /rpc-terminal and/or GET /rpc-browser.

With the new behavior, then the explorer could remain public for general use, but require a password only when a user attempts to use the RPC functionality.
@adamgall adamgall linked a pull request May 13, 2020 that will close this issue
Open
@Kixunil
Copy link
Contributor

Kixunil commented Aug 1, 2020

It'd be even better to support both as a DoS protection.

@adamgall
Copy link
Author

adamgall commented Aug 1, 2020

Not a bad idea. I'll try to rebase the PR (to fix conflicts), and keep the original functionality. Might need to think about the design a little bit.

@Kixunil as a user of btc-rpc-explorer, how would you want to configure it to switch between those two auth modes?

@Kixunil
Copy link
Contributor

Kixunil commented Aug 1, 2020

Hmm, maybe BTCEXP_BASIC_AUTH_VIEW_PASSWORD and BTCEXP_BASIC_AUTH_MANAGE_PASSWORD?

Eventually, I'd love to see support for some kind of SSO though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Basic Auth only on protected routes adamgall/btc-rpc-explorer
4 participants
@adamgall @Kixunil and others