search

ActivityWatch / aw-server-rust

High-performance implementation of the ActivityWatch server, written in Rust
Mozilla Public License 2.0
187 stars 55 forks source link

Password based authentication #494

Open powellnorma opened 3 days ago

powellnorma commented 3 days ago

So that not any app (or even extension) can access all of AW's data. Web-UI would also need to authenticate with a password (login could be saved via cookie, though). The Client-Libraries (python + JS) would have to get updated

powellnorma commented 3 days ago

Perhaps it would be enough, to simply add an HTTP-Header that contains the password for each API request. One optimization would be to hash that password twice - once client-side, once server-side. That way, the plain password is not included in the http headers.

In case the password is wrong, the backend could wait ~1s before giving a 403 response