search

dansan / spring-replay-site

Website to upload, comment and download replays from/for the SpringRTS engine
http://replays.springrts.com/
GNU General Public License v3.0
11 stars 1 forks source link

recommendation in README.replay-upload is bad #108

Closed abma closed 7 years ago

abma commented 7 years ago

"WARNING: this configuration will send your autohost password to the replay site for authentication. If you don't want this to happen, you can create a new Spring account just to upload the replays (replace %ahName and %ahPassword by this account name and password in previous step)"

unused accounts on the lobby server are deleted (atm after 30 days)

https://github.com/spring/uberserver/issues/225#issuecomment-331391491

the autohost account should be used for uploading!

abma commented 7 years ago

note: authentificating via replays.springrts.com doesn't update last login time

dansan commented 7 years ago

IMO the recommendation in the README is a good one: use different accounts whenever you can! IMO the error is with the login service not updating the last login time. I will however change the text to point out this problem, so that autohost owners can take appropriate action.

abma commented 7 years ago

IMO the recommendation in the README is a good one: use different accounts whenever you can!

the recommendation makes it much more difficult to find the cause of problems. when it comes to security you're right. Still in this case i would suggest to use the same account as the database in the backend is the same which is used for authentification and the script also has to run in the same context as the autohost.