Authentication for external sevices
https://lemmy.world/post/20469777
=> More informations about this toot | More toots from Dust0741@lemmy.world
Tunnels are not authentication.
Are you asking how to have each service challenge for authentication? That’s up to the software.
=> More informations about this toot | More toots from just_another_person@lemmy.world
True.
I would like to add another authentication.
I guess my question is how trustworthy is built-in authentication? I’m not really talking about vulnerabilities, but that’s a part of this, but how much trust can I put into a small projects login page being secure?
=> More informations about this toot | More toots from Dust0741@lemmy.world
I’m not sure how much you can trust them, but you might want to have a look at Authelia
=> More informations about this toot | More toots from jeffreyosborne@lemm.ee
That’s really up to the software again. If you’re not technically inclined enough to run through the code, that’s fine, but you have to trust that other people are.
Go and search GitHub issues or this project by name for what you’re concerned about.
Authentication is also not security, btw. It’s just access. If you can be more specific about your concerns in your post, you may get more direct answers.
=> More informations about this toot | More toots from just_another_person@lemmy.world
“authentication is not security,” can you elaborate on that?
Your statement doesn’t really overlap with my understanding of security, as “just access” seems critically relevant to how secure user data is, for example. Am I missing something?
=> More informations about this toot | More toots from tofubl@discuss.tchncs.de
Authentication is simply identifying a user.
Authorization is securing access to assets.
You can find a lot of reading about this if the distinction is confusing.
=> More informations about this toot | More toots from just_another_person@lemmy.world
Right, thanks.
=> More informations about this toot | More toots from tofubl@discuss.tchncs.de
None. Dashy’s authentication was famously literally security theatre even with Keycloak. You could just pause the load in browser and have full access to the config. Because it let you iframe whatever you could now do so with local services to enum. Somehow Jellyfin is unbustable though. So it’s a bit of a crapshoot. Look at past vulnerabilities. Stuff like XSS unless stored you don’t need to worry about, clickjacking, tab nabbing etc. On the other hand anything that’s arbitrary file read, SQLI, RCE, LFI, RFI, SSRF etc. I would look at seriously. E.g. don’t make your 13ft public because it can be used to literally enumerate your entire private network.
=> More informations about this toot | More toots from LainTrain@lemmy.dbzer0.com
I’d like to do the same, but atm I use nginx to serve all the web interfaces… And keycloak support is either a plus subscription feature or made to work with hacky Lua scripts.
So for now it’s security through obscurity, I got a wildcard cert and the pages are accessed based on subdomain. So afaik nobody has a clue unless they start iterating common subdomain names. (At some point™️ I’m adding proper auth though)
=> More informations about this toot | More toots from FierySpectre@lemmy.world This content has been proxied by September (3851b).Proxy Information
text/gemini