Feature request: Authentication for http server #112

New Issue

saavagebueno · 2025-11-20T04:20:26-05:00

saavagebueno commented

2025-11-20 04:20:26 -05:00

Originally created by @qdm12 on GitHub (Mar 23, 2021).

Originally assigned to: @qdm12 on GitHub.

What's the feature?

Authentication mechanism for http server.

Extra information?

This blocks the new Web UI which will allow to modify settings, see tokens etc.
We don't want to expose something to outside without authentication (in case some newbie port forwards and doesn't set authentication for example). That web ui might end up as a mobile app too so we definitely need an authentication system.
Using the same file data backend used for records update history should be fine to store auth data and logs

Originally created by @qdm12 on GitHub (Mar 23, 2021). Originally assigned to: @qdm12 on GitHub. 1. What's the feature? Authentication mechanism for http server. 2. Extra information? - This blocks the new Web UI which will allow to modify settings, see tokens etc. - We don't want to expose something to outside without authentication (in case some newbie port forwards and doesn't set authentication for example). That web ui might end up as a mobile app too so we definitely need an authentication system. - Using the same file data backend used for records update history should be fine to store auth data and logs

saavagebueno added the Status: 🔒 After next release Priority: 🚨 Urgent labels 2025-11-20 04:20:26 -05:00

saavagebueno commented

2025-11-20 04:20:27 -05:00

@fredericrous commented on GitHub (May 18, 2021):

I personally wouldn't want an authentication feature unless it is compatible with oauth2. The webui is behind https://www.authelia.com/ on my nas. Another suggestion would be to make it possible to opt-out from the authentication mechanism

@fredericrous commented on GitHub (May 18, 2021): I personally wouldn't want an authentication feature unless it is compatible with oauth2. The webui is behind https://www.authelia.com/ on my nas. Another suggestion would be to make it possible to opt-out from the authentication mechanism

saavagebueno commented

2025-11-20 04:20:27 -05:00

@qdm12 commented on GitHub (May 18, 2021):

Oh yeah definitely opt out authentication. But I really want to make it enabled by default as we don't want to have some network noob (including me sometimes) port forward it and then have malicious users change DNS settings, that would be baaaaddd.

By the way, I'm almost there on this ticket (being stuck in https://github.com/qdm12/dns/tree/v2.0.0-beta currently).

@qdm12 commented on GitHub (May 18, 2021): Oh yeah definitely opt out authentication. But I really want to make it enabled by default as we don't want to have some network noob (including me sometimes) port forward it and then have malicious users change DNS settings, that would be baaaaddd. By the way, I'm almost there on this ticket (being stuck in https://github.com/qdm12/dns/tree/v2.0.0-beta currently).

saavagebueno commented

2025-11-20 04:20:27 -05:00

@FragRot commented on GitHub (Dec 26, 2024):

May I know when would authentication be implemented? Planning to deploy this application but I'm holding off for now due to lack of authentication.

@FragRot commented on GitHub (Dec 26, 2024): May I know when would authentication be implemented? Planning to deploy this application but I'm holding off for now due to lack of authentication.

saavagebueno commented

2025-11-20 04:20:27 -05:00

@qdm12 commented on GitHub (Dec 26, 2024):

Use a reverse proxy and set authentication with the proxy for the time being. This issue isn't urgent until it can modify settings, since right now it's read only and doesn't show any secret/private data really.

@qdm12 commented on GitHub (Dec 26, 2024): Use a reverse proxy and set authentication with the proxy for the time being. This issue isn't urgent until it can modify settings, since right now it's read only and doesn't show any secret/private data really.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ddns-updater#112