administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-02-11 13:45:25 +03:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

implement auth via new external port

Browse Source
This commit is contained in:
Blake Blackshear 2024-05-15 06:04:14 -05:00
parent 8750dfb222
commit 6d6a54c5ae
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docker/main/rootfs/usr/local/nginx/conf/auth_location.conf
View File

@ -15,7 +15,7 @@ location /auth {
# Pass info about the request # Pass info about the request
proxy_set_header X-Original-Method $request_method; proxy_set_header X-Original-Method $request_method;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri; proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Server-Port $server_port;
proxy_set_header Content-Length ""; proxy_set_header Content-Length "";
# Pass along auth related info # Pass along auth related info
proxy_set_header Authorization $http_authorization; proxy_set_header Authorization $http_authorization;

6
docker/main/rootfs/usr/local/nginx/conf/nginx.conf
View File

@ -62,6 +62,9 @@ http {
} }
server { server {
# intended for external traffic, protected by auth
listen [::]:8080 ipv6only=off;
# intended for internal traffic, not protected by auth
listen [::]:5000 ipv6only=off; listen [::]:5000 ipv6only=off;
# vod settings # vod settings
@ -268,8 +271,7 @@ http {
} }
location /api/version { location /api/version {
# dont auth the healthcheck endpoint include auth_request.conf;
auth_request off;
access_log off; access_log off;
rewrite ^/api(/.*)$ $1 break; rewrite ^/api(/.*)$ $1 break;
proxy_pass http://frigate_api; proxy_pass http://frigate_api;

5
frigate/api/auth.py
View File

@ -127,6 +127,11 @@ def set_jwt_cookie(response, cookie_name, encoded_jwt, expiration):
def auth(): def auth():
success_response = make_response({}, 202) success_response = make_response({}, 202)
# dont require auth if the request is on the internal port
# this header is set by Frigate's nginx proxy, so it cant be spoofed
if request.headers.get("x-server-port", 0, type=int) == 5000:
return success_response
fail_response = make_response({}, 401) fail_response = make_response({}, 401)
fail_response.headers["location"] = "/login" fail_response.headers["location"] = "/login"