Addl. Base parameter

[i003814]

I like the base_url parameter, but there should be a second parameter like base_url_home.

Reason:
If flashpaper is behind a reverse proxy, one might want to open the retrieval path (based on base_url) and protect the creation of new secrets. This all works, with one exception:
When a secret has been retrieved and the user clicks on Home, then he is able to create a secret without authentication i.e. the creation is no longer protected.
In order to have all options, the button should call the new parameter base_url_home.

[AndrewPaglusch]

Interesting idea. I wonder if this might be better implemented at the reverse-proxy level. What do you think?

[i003814]

You are right. I already went into this direction (see below).
This is the content of my vhost file:

ServerName flashpaper.domain.com
ErrorLog logs/flashpaper.error.log
CustomLog logs/flashpaper.custom.log common
LogLevel info

ProxyPreserveHost On
AllowEncodedSlashes On

ProxyErrorOverride On
SSLCertificateFile /etc/ssl/certs/star_domain_net.crt
SSLCertificateKeyFile /etc/ssl/private/star_domain_net.key
SSLCertificateChainFile /etc/ssl/certs/star_domain_net_bundle.crt

RewriteEngine On
AllowEncodedSlashes On
SSLEngine On
SSLProtocol all
SSLProxyEngine On
RequestHeader set Front-End-Https "On"
RequestHeader set X-Forward-Proto 'https' env=HTTPS

SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
SSLProxyProtocol all

RequestHeader set ClientProtocol HTTPS

ProxyPass /fps/ http://linux-5dock.domain.com:8085/
ProxyPassReverse /fps/ http://linux-5dock.domain.com:8085/

ProxyPass / http://linux-5dock.domain.com:8085/
ProxyPassReverse / http://linux-5dock.domain.com:8085/

Enable authentication

<Location /fps/>
    Require all granted
    SetOutputFilter INFLATE;proxy-html;DEFLATE
    ProxyHTMLURLMap /fps/ /
    RequestHeader unset Accept-Encoding
</Location>

Enable authentication

<LocationMatch "^/(?!fps/).*">
    AuthType openid-connect
    Require valid-user
    OIDCUnAuthAction      auth
    ProxyPass                                          http://linux-5dock.domain.com:8085/
    ProxyPassReverse                                   http://linux-5dock.domain.com:8085/
</LocationMatch>

With the parameter base_url, I defined to generate the links with /fps/...
The intention was to leave /fps/ unprotected and / protected. This all works, except for the case where a secret link has already been used and there is a second attempt to use it. It will show, that the link is not available anymore and a Home button.

The Home button must reload / and not stay on /fps/.

This is the reason behind the new parameter, so any user could send it to wherever they want...