HTTP Basic Authentication for security about lute

[jzohrab]

Hi @99MengXin , thanks for the PR.

One thing I don't want is to force users (especially me) to have to log in all of the time. Would this code change make that happen, or is there a clever way that we can work around it? (e.g., if the USER and PASSWORD are missing from the .env file, don't require a login.) Or, does this merely need to be documented somewhere on the WIKI?

Cheers!

[99MengXin]

Hi @jzohrab ,

1. The username can't be empty.
2. You need log in only at the first time, it's difficult to log out actually. That's why we need use incognito window to log in every time. See http - How to log out user from web site using BASIC authentication? - Stack Overflow

[jzohrab]

Got it, thanks. So, what should I do with this info? I wonder if I should just put a note in the wiki, with some comments in the .env.example* files. I don't want to make this the default behaviour for the app, I know that I'll find it annoying. :-)

If you're OK with just wiki, that's super. There might be other possibilities (e.g., a special "APP_ENV=secure" or something in the .env file, and then mucking around with the configuration .yml file, per notes in https://symfony.com/doc/current/configuration.html), but I'm not sure if it will work out.

[99MengXin]

I'm OK with wiki, just let people know there is way to secure.

Users can follow this instruction and add the feature by themself.

[jzohrab]

Thanks very much @99MengXin for getting this started. I simplified the file a bit and committed it to the develop branch, and added notes to the wiki about config (https://github.com/jzohrab/lute/wiki/Security). I'll use this for a bit and see how it goes, and will try it out again when I make release 2.0.1. Thanks!