Require HTTP Basic Auth for all RPC/CLI #88
Conversation
|
👋 Thanks for assigning @tnull as a reviewer! |
Adds basic auth to protect the RPC from potential attackers.
|
🔔 1st Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 2nd Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 3rd Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 4th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 5th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 6th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 7th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 8th Reminder Hey @tnull! This PR has been waiting for your review. |
tnull
left a comment
tnull
left a comment
There was a problem hiding this comment.
So far we assumed the RPC API to not be publicly accessible. If we do assume it is, we should probably also start to take futher precautions (e.g., take a look at DoS protection, etc).
That said, I'm not against adding authentication to the RPC protocol, however, if we do:
- We should never transmit unhashed & unsalted passwords/credentials.
- Authentication's utility is very limited if we're sending credentials over unencrypted channels (actually, it might just give a false sense of security). So if we add authentication, we should probably start looking into (requiring) TLS for the RPC connections, and add corresponding helpers to generate and configure corresponding self-signed certificates.
| .client | ||
| .post(url) | ||
| .header(CONTENT_TYPE, APPLICATION_OCTET_STREAM) | ||
| .basic_auth(username, Some(password)) |
There was a problem hiding this comment.
I don't think we should ever transmit an unhashed and unsalted password.
3 participants
Adds basic auth to protect the RPC from potential attackers.