Replies: 6 comments 21 replies
-
|
I think that could work. For my use case, I'm going to try putting it behind an my LB and putting oauth in front of it, specifically with traefik OIDC authentication middleware. I'll see how well that works. |
Beta Was this translation helpful? Give feedback.
-
|
Would love to see this feature, so I could use Hister across my browser and OSes. I use Firefox and Brave on Fedora, Android and Windows. I won't expose a hister server without any authentification. |
Beta Was this translation helpful? Give feedback.
-
|
My usecase for authentication is preventing other software running as separate users from accessing (including modifying) my search history just because they have access to http://127.0.0.1:4433. A simple solution would be to generate a random token and require that it is included in every URL, e.g. http://127.0.0.1:4433/token-goes-here/... Syncthing has a similar problem, it does not require authentication by default and I don't like that it requires the user to set password and username. There is no need for username, and there is no need for the user to invent password manually because user needs to use secure password generator manually then or may set an insecure password: syncthing/syncthing#3357 Jupyter Notebook is using tokens to give you access to the web interface, when it is started it starts the browser with the token in the URL. |
Beta Was this translation helpful? Give feedback.
-
|
What I think I actually want is the UI being packaged into the extension, then there is no need to serve the UI over 127.0.0.1:4433 at all, only the API. API can be authenticated with a token that you need to copy from the config to the extension once, and user does not need to authenticate into the web UI at all if it is part of the extension. |
Beta Was this translation helpful? Give feedback.
-
|
With 0.8 having token authentication is already an improvement. The problems:
|
Beta Was this translation helpful? Give feedback.
-
|
Bundled support for OIDC would be awesome! |
Beta Was this translation helpful? Give feedback.

Uh oh!
There was an error while loading. Please reload this page.
-
Let's discuss what are the requirements and use-cases for authentication.
There is a quick and cheap solution: creating a single "master" password with a command line tool (e.g.:
hister set-password) and storing it's hash in the config file/data dir. If the hash exsists, then the web interface shows a password prompt for unauthenticated visitors and unlocks the functionality only after the user provided the right password.What do you think?
Beta Was this translation helpful? Give feedback.
All reactions