1

I'm looking in to using the wwwhisper addon to add authentication to a simple webapp I'm building. The webapp produces a small JSON file which will be consumed by an iOS app. I would like all users to be able to view the JSON file without authentication and require backend access to go through wwwhisper. Is this possible? From what I've seen so far, you can only specify that certain URLs can be authorized for all authenticated users.

1 Answer 1

1

wwwhisper allows to specify URLs that do not requrie authentication. You can set * as an access control rule to achieve this (*? rule also allows everyone, but requires authentication).

Requests to such URLs still go to the wwwhisper backend for an authorization check, but the backend always grants access to them.

This feature is available only in paid plans (this is because applications with locations open to everyone generate bigger load on the backend).

If you don't want requests to open locations to go to the wwwhisper backend, you could theoretically achieve this with a custom Rack middleware that would check the path and either pass the request to the wwwhisper middleware, or directly to your app. Such mode isn't supported out of the box and would require some careful coding to handle this correctly. The reasoning behind this is that tricky auth-related code should be preferably handled in a single place. Moving some auth checks out of the auth backend can be potentially a source of security bugs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.