search

mxpv / podsync

Turn YouTube or Vimeo channels, users, or playlists into podcast feeds
MIT License
1.52k stars 266 forks source link

Question related to security/password protection #149

Closed Th0masL closed 4 years ago

Th0masL commented 4 years ago

Hi !

I've just discovered this project, and that's exactly what I was looking for, to create my self-hosted/custom Podcast library, so thank you very much for this amazing program :)

On the player side, I'm using it with AntennaPod, which is a great opensource project also, and I have a question regarding the security of the content.

Is there a way to protect the web page that is published by Podsync, so only my authenticated users can access the Podcasts ?

For example, in AntennaPod, there is a way to define username and passwords. I'm quite new to the Podcast/RSS world, so I'm not exactly sure what (or even if any) sort of authentication mechanism is available for Podcast/RSS, but I would love to be able to protect my podcast library from unauthenticated users.

Does someone has some knowledge about that ?

I was thinking of publishing Podsync behind an Nginx proxy, so technically speaking I guess it would be possible to implement some sort of authentication mechanism on Nginx, but I'm wondering someone already tried to implement such thing ?

As a first security measure, is it possible to hide the content of the main folder ? That way, it would required to know the Feed's URL in order to be able to access it. It's not perfect, but that might be a good starting point.

Thanks :)

726a67 commented 4 years ago

To 'hide' your content, site index enumeration can be mostly addressed by this workaround in #53.

'Private' (i.e. password-protected) podcast feeds are definitely a thing, and most podcast clients support them, depending upon the authentication method used. Basic authentication tends to be the most widely supported implementation.

Golang's web server does support basic authentication, but I'd highly recommend using a reverse proxy to serve that function, especially if you're simultaneously hosting any other web-based services. A decent reverse proxy solution will be able to provide you not only authentication, but also handle subdomain redirects, ssl certificate generation, etc. As you mentioned, nginx can in fact handle this, but I'd also take a look at caddy (for simplicity) and traefik (for customization).

Th0masL commented 4 years ago

Thank you for your answer, that's what I needed to know :)

dave0461 commented 4 years ago

@726a67 Would you be able to provide a Basic Authentication example with this setup?