Add HMAC-based authentication for RPC/CLI #88
Conversation
|
👋 Thanks for assigning @tnull as a reviewer! |
benthecarman
force-pushed
the
auth
branch
2 times, most recently
from
d0ff118 to
27f36c4
Compare
|
🔔 1st Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 2nd Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 3rd Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 4th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 5th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 6th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 7th Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 8th Reminder Hey @tnull! This PR has been waiting for your review. |
tnull
left a comment
tnull
left a comment
There was a problem hiding this comment.
So far we assumed the RPC API to not be publicly accessible. If we do assume it is, we should probably also start to take futher precautions (e.g., take a look at DoS protection, etc).
That said, I'm not against adding authentication to the RPC protocol, however, if we do:
- We should never transmit unhashed & unsalted passwords/credentials.
- Authentication's utility is very limited if we're sending credentials over unencrypted channels (actually, it might just give a false sense of security). So if we add authentication, we should probably start looking into (requiring) TLS for the RPC connections, and add corresponding helpers to generate and configure corresponding self-signed certificates.
benthecarman
changed the title
|
Used claude to swith to a HMAC based approach instead, this way we aren't leaking the secrets in the request, working on the TLS stuff in a follow up |
benthecarman
force-pushed
the
auth
branch
4 times, most recently
from
3c5e9fc to
2f04d98
Compare
Implements time-based HMAC-SHA256 authentication using a shared API key. Each request includes a timestamp and HMAC in the X-Auth header, preventing replay attacks with a 60-second tolerance window. Co-Authored-By: Claude Opus 4.5 <[email protected]>
3 participants
Implements time-based HMAC-SHA256 authentication using a shared API key.
Each request includes a timestamp and HMAC in the X-Auth header, preventing
replay attacks with a 60-second tolerance window.