basic authentication with nginx about send

[timvisee]

So it seems that somehow the browser requests some resources without passing the authentication header?

I'm not sure.

Is this a known issue? Is there a standard way to deploy send behind a proxy with basic auth?

It is not. I did never deploy Send with BasicAuth myself, though there have been others who did, with success. I don't have much experience with BasicAuth either, it may be worth checking what headers affect it.

Please note that when uploading a file, it is done so over a websocket rather than a regular HTTP request. That might need special attention.

[DavyLandman]

I've been debugging this, it looks like the XHR request don't use the credentials of the browser? That means that the calls to API fail, and that is what causing the downloads to fail.

I've been reading a bit, and it seems like it might be resolved by setting the withCredentials property on the xhr, but I don't know how to test that currently.

[martin-braun]

@timvisee I think it would make sense to provide a way to configure credentials in the server configuration that need to be put for home use. I'd like to host send for my partner and me and I wish to prevent strangers from using it on my server.

[ben-64]

I face exactly the same problem.
Due to basic authentication and reverse proxy, all links are expired, but the real reason is the authentication problem.

[AlassaneWone]

I don't know if this is relevant or helpful, but I just implemented Send with basic authentication on my Apache server.

I created users and passwords using this command (-c create the file so, if you want to create more users, just get rid of it):

htpasswd -c /etc/apache2/.htpasswd <username>

I also added this bit of code to the VirtualHost so that everyone can access downloads via links, but only authentified users can access the upload page.

        <LocationMatch "^/$">
                AuthType Basic
                AuthName "Send"
                AuthUserFile /etc/apache2/.htpasswd
                Require valid-user
                Order Deny,Allow
        </LocationMatch>

        <LocationMatch "^/download/">
                allow from all
                Satisfy any
        </LocationMatch>

However, there's still an issue I couldn't figure out how to resolve.
Accessing the download page and clicking on the 'Send' logo (up left of the page) redirects an unauthenticated user to the upload page without requiring username or password.

Feel free to notify me if you discover a better solution, security issues, or anything that could be improved.