Add password protection for published site #30

New issue

Closed

opened 2026-02-09 14:52:35 +00:00 by mik-tf · 0 comments

mik-tf commented

2026-02-09 14:52:35 +00:00

Owner

Context

The web UI is currently publicly accessible with no authentication. Some content is not intended to be public.

Expected Behavior

Support optional password protection for the web interface. When enabled, users must authenticate before accessing any content.

Suggested Approach

HTTP Basic Auth as the simplest option
Configurable via environment variable (e.g., HEROBOOKS_PASSWORD)
When the env var is empty or unset, no auth is required (backward-compatible)
When set, all routes require authentication
Username can be fixed (e.g., hero) or also configurable

Notes

This covers the web UI and API endpoints
MCP endpoint may need separate consideration (API key vs Basic Auth)
grid_name_proxy handles TLS, so Basic Auth over HTTPS is secure

## Context The web UI is currently publicly accessible with no authentication. Some content is not intended to be public. ## Expected Behavior Support optional password protection for the web interface. When enabled, users must authenticate before accessing any content. ## Suggested Approach - HTTP Basic Auth as the simplest option - Configurable via environment variable (e.g., `HEROBOOKS_PASSWORD`) - When the env var is empty or unset, no auth is required (backward-compatible) - When set, all routes require authentication - Username can be fixed (e.g., `hero`) or also configurable ## Notes - This covers the web UI and API endpoints - MCP endpoint may need separate consideration (API key vs Basic Auth) - grid_name_proxy handles TLS, so Basic Auth over HTTPS is secure