Open mitra42 opened 4 years ago
Dan to do some research ....
I think this is linked to #119 but its the identity of the calling server needing to get passed through the Https
@mitra42 and I had another talk about this last night and we decided that we're not sure that there is a business case to do this right now. After much investigation, I believe that when we do this we should do this by:
See https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/ for example of setup and signing.
The server should reject sync requests for unknown servers
For testing purposes - maybe a flag to allow a promiscuous mode ?