search

jpsider / RestPS

Simple ReST Framework for Powershell
MIT License
112 stars 30 forks source link

Enhance security by protecting the shutdown #78

Closed chbwien closed 1 year ago

chbwien commented 1 year ago

To my knowledge, the /endpoint/shutdown is hardcoded. How can this be changed, so a shutdown can be set to any URL AND needs a password or token? Currently, if someone knows I am running this module, s/he can call this fixed URL and shut down the REST server...

jpsider commented 1 year ago

Well, we could update this to be 'behind' whatever authenticate you are providing. Do you think that would be a POST or a PUT?

chbwien commented 1 year ago

The easiest way I can imagine: Remove the hardcoded shutdown URL and let the user shutdown the server from any endpoint by using a global variable or function. So the default setting just needs to include a simple endpoint description and if somebody like me doesn't like this, one can write it's own endpoint including any form of authentication and if needed running subscripts to shutdown other things first.

How about this?

jpsider commented 1 year ago

Sounds reasonable. Want to do a PR? Or want me to make the changes?

chbwien commented 1 year ago

If you want me to do it, I should have this in a day or two.

jpsider commented 1 year ago

Yeah, go ahead and give it a shot!

chbwien commented 1 year ago

It was only a very small change. So it is done. See my pull request.

jpsider commented 1 year ago

New version deployed! https://www.powershellgallery.com/packages/RestPS/7.0.56