tobychui
[ENHANCEMENTS] Allow bypass of Basic Auth for specified subnets
Is your feature request related to a problem? Please describe. I run services at home that i wish to also access externally, basic auth is a great option for this, however i have seen other similar apps that allow bypass of basic auth for specified subnets, eg 192.168.0/23 or 10.0.0./23
Describe the solution you'd like In basic auth config, allow to specify subnets that will bypass basic auth
Describe alternatives you've considered There is no workaround currently in Zoraxy
Additional context
+1. This could potentially be quite easy to implement with an option of adding an access control list to the basic auth option or, as in NPM, have the option to "satisfy any" so either the access control list OR the basic auth.
@FirefoxNL Thanks for the input. For basic auth, I kinda want to keep it simple (as it is mostly for legacy browsers / embedded machines).
There is an up-coming Zoraxy SSO + oAuth feature which I guess might be more interesting for these types of uses cases. Though, I will still keep this here just in case someone want to pick it up and create a PR 👍🏻
+1, this feature would be great just like npm auth if not whitelisted + access ip
I would like this as well. This is the only feature that keeps me away from zoraxy
not joking, i went back to npm just because of this, zoraxy >>>>>> npm, but the fact i cant auth some apps unless i can bypass by making them "Trusted ips" is an absolute deal breaker for me
Finally got time to implement this after a year or so.
In the next release you will be able to add IP / CIDR into exclusion list for basic auth.
@tobychui That looks very good! Looks like this is now implemented per proxy, which is nice! Have you considered implementing this on the access control? I feel like that already covers security and allows you to configure it once and use the exclusion for multiple hosts. :)
@FirefoxNL Nope, as Authentication Provider and Access Control Rules are two separated modules, they cant be merged together easily without some big rewrite.
Closing this as the feature has already been implemented. But in general you should use path prefix instead of IPs as mentioned above, IP can be spoofed and it is not possible for Zoraxy to get client IP in 100% accuracy.