Make the trivabble site instance private #4

New Issue

Closed

opened 2022-10-11 20:31:24 +02:00 by viba1 · 4 comments

viba1 commented

2022-10-11 20:31:24 +02:00

Allowing (by configuration) to make the site private, so that only registered and authorized users can access the site.
For exemple, in order to secure exchanges on the chat and to protect the server against inappropriate uses.

Allowing (by configuration) to make the site private, so that only registered and authorized users can access the site. For exemple, in order to secure exchanges on the chat and to protect the server against inappropriate uses.

raph commented

2022-10-12 09:31:29 +02:00

Owner

Would a HTTP basic auth cover your use case? the site administrator can give a password to users and block access to people who don't have a password.

Managing registrations from Trivabble itself would add some complexity, but might make it more user-friendly, allowing users to change their passwords. However, open registrations would not prevent abuse. How do you think we should handle this? Invitations (through a link)?

We could avoid handling authentification and implement something like Oauth / Open ID (-Connect)

Would a HTTP basic auth cover your use case? the site administrator can give a password to users and block access to people who don't have a password. Managing registrations from Trivabble itself would add some complexity, but might make it more user-friendly, allowing users to change their passwords. However, open registrations would not prevent abuse. How do you think we should handle this? Invitations (through a link)? We could avoid handling authentification and implement something like Oauth / Open ID (-Connect)

viba1 commented

2022-10-18 23:21:59 +02:00

Author

Would a HTTP basic auth cover your use case? the site administrator can give a password to users and block access to people who don't have a password.
==> Yes, something like that

Maybe by considerating a technical solution like "Basic Login System" or described in this video: https://www.youtube.com/watch?v=-RCnNyD0L-s

Would a HTTP basic auth cover your use case? the site administrator can give a password to users and block access to people who don't have a password. ==> Yes, something like that Maybe by considerating a technical solution like "[Basic Login System](https://codeshack.io/basic-login-system-nodejs-express-mysql/)" or described in this video: https://www.youtube.com/watch?v=-RCnNyD0L-s

raph commented

2022-10-19 02:01:26 +02:00

Owner

Would a HTTP basic auth cover your use case? the site administrator can give a password to users and block access to people who don't have a password.

Yes, something like that

All right, so this is best implemented at the reverse-proxy level (Apache / Nginx), because they are both battle-tested.

I'd rather avoid adding a dependency on a DBMS and reimplementing a login system that risks not being very good / safe without a strong reason for it. A login system also has legal implications (GDPR for instance).

>> Would a HTTP basic auth cover your use case? the site administrator can give a password to users and block access to people who don't have a password. > Yes, something like that All right, so this is best implemented at the reverse-proxy level (Apache / Nginx), because they are both battle-tested. I'd rather avoid adding a dependency on a DBMS and reimplementing a login system that risks not being very good / safe without a strong reason for it. A login system also has legal implications (GDPR for instance).

viba1 commented

2022-10-25 14:51:06 +02:00

Author

Ok with your technical proposition
Issue could be tag as solved

Ok with your technical proposition Issue could be tag as solved