wrr / wwwhisper

Access control for web servers

wwwhisper is an authorization layer for HTTP servers that controls which resources can be accessed by which visitors. wwwhisper works with nginx auth-request module, it is also available as a Heroku add-on that provides wwwhisper as a service for Ruby and Node.js applications on Heroku.

• wwwhisper grants access to HTTP resources based on visitors' email addresses. Password-less access tokens are used to prove that a visitor owns an allowed email.

• wwwhisper is application independent. It can be used for anything that HTTP server returns - dynamic content, static files, content generated by back-end servers. No support from applications or back-ends is needed.

• wwwhisper provides an admin web UI for manipulating permissions. Access to the admin is protected by wwwhisper, this allows to easily add and remove admin users.

Quick tour

A user that visits a wwwhisper-protected site is presented with a login prompt:

The 'Request login token' button sends a link with an email verification token to the provided email address. The link is valid for 30 minutes and for a single successful login.

After the link is clicked, wwwhisper checks that the user is allowed to visit the URL. If this is the case, the user is taken to the site:

HTTP server inserts a small overlay in the lower-right corner of each protected HTML document. The overlay contains the email of the current user and a 'Sign out' button.

If the user visits a location that he or she is not allowed to access, an error is displayed:

The admin application allows to easily grant and revoke access. There is no need to create, distribute and manage passwords:

Setup

Heroku users can use the wwwhisper add-on with any Rack (Rails, Sinatra) and Node.js Connect based application. This is the fastest and easiest way to setup wwwhisper access control, it requires only 3 lines of config.

NOTE: wwwhisper standalone setup procedure is outdated. The scripts need to be updated to include token email delivery configuration (originally wwwhisper used Mozilla Persona and didn't need to send emails with tokens to verify email ownership).

(Needs update: Following steps demonstrate how to install and configure nginx with wwwhisper authentication on Debian-derivative distributions (including Ubuntu). The steps should be easy to adjust to work on other POSIX systems. Unprivileged installation is good for experiments, development or if you don't have administrative privileged on the machine. System-wide installation is recommended for more serious deployments.)

If you are already using nginx, you may use these steps as guidance and adjust them to fit your current configuration.

Final remarks

1. Make sure content you are protecting can not be accessed through other channels. If you are using a multi-user server, set correct file permissions for protected static files and communication sockets. If nginx is delegating requests to back-end servers, make sure the back-ends are not externally accessible.

2. Use SSL for anything important.

wwwhisper's Issues

User creation fails when open location that requires login is visited by a new user

The execution path wasn't correctly updated to the new django-browserid API. User email is incorrectly obtained and causes auth request 500 failure.

Europe!

I guess not an issue but would be great to see this add on available in Europe

Prevent 401 error on open routes

I get this error on open routes:

Failed to load resource: the server responded with a status of 401 () /wwwhisper/auth/api/whoami/?_=1525223489528

Is there any way to prevent this?

Update configs and docs to support nginx1.6.0+ that has auth_request module built in

auth_request no longer needs to be installed from an external source.

Upgrade to Django 1.8

Getting Logged In Email Address

I'm using WWWhisper in my RoR application, but I want to know if there's a way to get the user's email that was used to log-in through whisper? Is there someway I can hook into the whisper layer from within my app to get this information?

Update to django-browserid 1.0.0

I'm trying to package wwwhisper for Arch Linux and (Arch being Arch) it packages the latest django-browserid. Any reason wwwhisper still uses 0.10.1?

Failed to send the token to {EMAIL}: Cross origin requests not allowed.

Hi, I have a heroku node express app with wwwhisper addon. I'm pretty sure it's setup correctly and I've enabled cors too. However when requesting an access token I'm getting this error message - "Failed to send the token to {EMAIL}: Cross origin requests not allowed." any pointers? thanks.

Ability to make certain endpoints completely public

This would be extremely useful for health checking and continuous deployment tools.

Email with link and token

For my team it takes about 10+ minutes to receive the email with the link.

We are based in NH and we are testing out your add-on with 'solo' version.

Is it supposed to take this long?

Update to the newest version of the django-browserid library

wwwhisper does not work after updating to the newest django-browserid API.

images in readme are broken

Append Google Account support

Append Google Account support

Switch from GPL to more liberal MIT license

At this moment wwwhisper does not include any third party GPL code that would block the switch of the license. Since starting the project I've changed my preferences and I'm now more in favor of simpler licenses. For a server side program GPL offers little benefits anyway, because everyone is allowed to modify and run modified versions of the software without publicly sharing the modifications.

uwsgi buffer-size

After I got some weird 500 errors popping up while using wwwhisper I wanted to find the source of the error and it ended up being uwsgi fault.

The default uwsgi configuration allocates 4096 bytes for the headers of each request. That ends up only allowing a request on a page protected by wwwhisper to only allow around 1100 characters as get parameters before errors starts to happened.

The error comes from the sub-request doing the authentication check.

401 error

2014.. [notice] 42#0: *2691, request: "HEAD /{x*1160}
2014.. [notice] 42#0: *2691, request: "HEAD /{x*1160} HTTP/1.1", subrequest: "/wwwhisper/auth/api/is-authorized/", host: "..."
2014.. [notice] 42#0: *2691, request: "HEAD /{x*1160}

500 error

2014.. [notice] 42#0: *2747, request: "HEAD /{x*1161}
2014.. [notice] 42#0: *2747, request: "HEAD /{x*1161} HTTP/1.1", subrequest: "/wwwhisper/auth/api/is-authorized/",
2014.. [error] 42#0: *2747 recv() failed (104: Connection reset by peer) while reading response header from upstream, request: "HEAD /{x*1161} HTTP/1.1", subrequest: "/wwwhisper/auth/api/is-authorized/", upstream: "uwsgi://unix:/wwwhisper/sites/.../uwsgi.sock:",    
2014.. [notice] 42#0: *2747, request: "HEAD /{x*1161} HTTP/1.1", subrequest: "/50x.html", upstream: "uwsgi://unix:/wwwhisper/sites/https.....443/uwsgi.sock",    
2014.. [error] 42#0: *2747 auth request unexpected status: 502 while sending response to client, request: "HEAD /{x*1161}
2014.. [notice] 42#0: *2747, request: "HEAD /{x*1161}

You will get errors saying invalid request block size in the uwsgi output.

The solution is simple, and looks harmfull..
Adding --buffer-size=16384 to the list of parameters in https://github.com/wrr/wwwhisper/blob/master/run_wwwhisper_for_site.sh#L72 fixed the problem. Something to do upstream?

There is also some info at https://uwsgi-docs.readthedocs.org/en/latest/ThingsToKnow.html mentioning this.

I did not create a pull-request for this because the fix is way to simple..

Support rack-wwwhisper and connect-wwwhisper middlewares

Current scripts and documentation allow to setup wwwhisper with nginx. We have middlewares to easily integrate wwwhisper with Ruby's Rack and Node.js's Connect, but currently the middlewares are used only with wwwhisper service on Heroku.

The documentation and setup scripts need to be extended to allow using the middlewares with standalone wwwhisper instances. For example, current setup uses Unix socket for communication between nginx and wwwhisper. For Rack and Connect, standard TCP port is needed.

Any plans on adding Python for this add-on?

Looks cool, but I do most of my work w/ Flask. So I'm curious if there are any Python plans.

👍

Append Twitter Account support

Append Twitter Account support.

Persona will be shutdown :(

Persona will turn off the 30th of November, see https://developer.mozilla.org/en-US/Persona

There are a lot of information @ https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers and the source is available @ https://github.com/mozilla/persona

If Mozilla is shutting the service down, the state of the opensource project should also be considered. Will it die out? Maybe it is better to replace the login logic with something more generic? Maybe python social auth is the way to go (http://psa.matiasaguirre.net/)?

Cross origin domain error on requesting a login token

When I try to use a non-Heroku domain I receive this error:

Failed to send the token to XYZ: Cross origin requests not allowed.

Even though this domain is listed in the "Allowed addresses" section.

Configure a Docker container to run wwwhisper

Using Docker can simplify setup of a standalone wwwhisper instance.

Support authentication with aditional identity providers (Github, Twitter, Google Accounts)

Append Github Account support.

Heroku app rename action is not supported

After renaming Heroku app wwwhisper add-on stooped work correctly.

By opening Heroku app in the browser I got message:
Invalid request URL, you can use wwwhisper admin to allow requests from this address.

Add-on admin panel (...wwwhisper/admin/) also was not available.

I had to remove and add add-on once again to make it work and have access to the admin panel.

database integration

I just released an App to Heroku and I am exploring wwwwhisper. I noted that users' emails need to be in the list. I was wondering if there is an plan with integrating this with external databases? Basically, I would like the users to sign up.

Aliases are incorrectly required to be unique accross different sites

Pass an email of an authorized user to backends.

When a user is authorized, wwwhisper can return the user's email in HTTP header. Nginx can then pass the email to backends. Such setup will likely require HttpHeadersMore module.