search

0x2142 / frigate-notify

Event notifications for a standalone Frigate NVR instance
https://frigate-notify.0x2142.com/
MIT License
102 stars 9 forks source link

Question : ByPass Authorization for visualizing clip behind reverse proxy ? #126

Closed Nonobis closed 1 month ago

Nonobis commented 2 months ago

I am behind Ngninx Proxy Manager, how do you bypass auth when clicking on video/.snapshot link on received notification ?

freefd commented 2 months ago

@Nonobis you should set public_url in the configation settings with inline user:password@ notation.

But please note, this notation doesn't work with Telegram, it will disable this link

Nonobis commented 2 months ago

@freefd : I can encode password in base64 ? or it's must be in plain text ... it's not really secure

freefd commented 2 months ago

@Nonobis, well, a little longer explanation then :)

As per the RFC3986, this old known form has been marked as deprecated, but is still supported by any browser or http lib, and would work anyway.

I believe, your reverse proxy is authenticating requests already, so the possible solutions could be:

  1. You may use a password keeper solution to manage your credentials for quick and easily insert them into auth request fields. Personally, I use the self-hosted Vaultwarden vault with Bitwarden official apps for webkit-based and gecko-based browsers on desktop, and Keyguard for my phones.
  2. You can try an OAuth2 based SSO approach with a public or self-hosted IAM where authentication will be done transparently (in most cases). Here are the examples for Authentik, Keycloak, Authelia, and even Google.
Nonobis commented 2 months ago

not working ... i will wait and hope for https://github.com/0x2142/frigate-notify/issues/98 to be implemented one as an alternative.

johnwilson1969 commented 2 months ago

@freefd : I can encode password in base64 ? or it's must be in plain text ... it's not really secure

just as a note, base64 is encoding, not encryption and is not really safer than plaintext. And the username:password@ gets translated into a basic auth header with the encoded username/password and if using SSL, they should be encrypted at that point. I certainly understand being hesitant to be use urls with username/password as can end up in your browsing history... or possibly cached somewhere. I do it, but I understand why others do not.

freefd commented 1 month ago

Hi there, can it be closed in favor of #98?

Nonobis commented 1 month ago

Yes, including clip better i think