Skip to content

Implement cookie auth security (or another if possible) #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
6 tasks
VigneshVSV opened this issue Jul 27, 2024 · 0 comments
Open
6 tasks

Implement cookie auth security (or another if possible) #25

VigneshVSV opened this issue Jul 27, 2024 · 0 comments

Comments

@VigneshVSV
Copy link
Collaborator

To authenticate access to the hardware through HTTP, cookie auth needs to be added.

A separate branch has already been created for this.

Basic idea code (which also works) is available in release v0.1.2 under system_host folder. The logic is as follows

  • cookie secret is generated (needs to be given by the user?)
  • There's a permanent database which holds information about the credentials and a SQLite in memory database which holds a login entry after the given credentials are validated
  • necessary headers are set and credentials are verified for each request

Possible steps

  • Integrate this logic , the separated branch has only started the integration, but not completed
  • Write a dataclass or similar, which will accept information from the user what are the credentials
  • For each property, action and event, support separate credentials. By default, the Thing level credential must be supported for each property, action and even, but can be fine-tuned on case by case basis
  • Update TD generation logic to add information about security schemes, including interaction affordance specific security
  • Add a flag at class level allow_unauthorized_access, which has to be set to False if a HTTP server will be used. This should be the default behaviour to force the user to think about security.
  • Add tests

Same may be done for another security method as well. I do not know how to code other security schemes.

@VigneshVSV VigneshVSV added enhancement help wanted Extra attention/extra information is needed good first issue Good for newcomers and removed good first issue Good for newcomers labels Jul 27, 2024
@VigneshVSV VigneshVSV moved this to Backlog in hololinked Mar 1, 2025
@VigneshVSV VigneshVSV removed the status in hololinked Mar 1, 2025
@VigneshVSV VigneshVSV removed enhancement help wanted Extra attention/extra information is needed labels Apr 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: No status
Development

No branches or pull requests

1 participant