0

I've used npm http-server a few times to broadcast my mac's filesystem over the LAN so I can access it via the different OS devices and their browsers in my home, instead of enabling file sharing in system preferences. I used the basic code, and connected successfully via localhost, and my ip address + port on other devices:

http-server [path to broadcast/serve] -p [random port] -o

I know this is not a good idea as anyone who can connect and guess the port can access my system, so I'm wondering if there is a way to password protect this connection. Can users be given an authentication prompt when trying to connect to [myip]:[port]? I tried fooling around with http-server's -S -K and -C options, but couldn't figure out how to create these .pem files properly, or connect them to the server command.

I've also tried http-auth, and was able to create a prompt with the following code:

var http = require("http");
var auth = require("http-auth");
 
var basic = auth.basic({
    file: __dirname + '/htpasswd'
});
 
http.createServer(basic, function(req, res) {
res.end('User successfully authenticated: ' + req.user);
}).listen(8080);
It works, but the response stays static with 'user successfully authenticated: [user]', and doesn't continue to access my server (my filesystem).

I know I'm new to this, but have been attempting to password protect this type of local network connection for about a week. Any ideas?

1 Answer 1

0

First, the basic. It's true that with the default command everyone can browse your filesystem if s/he guesses the port, but if you're behind a firewall and/or NAT, only those inside your local network can connect to your computer. If you're the only person that connects to your LAN, then it's "safe" (assuming your Wi-Fi network can be trusted).

Second, if you're using that server just inside your LAN, you most probably won't need SSL (for which the -S, -K and -C options are). SSL is just about adding cryptography to the connection but it does NOT provide authentication.
SSL is very important over the public Internet, where the network can't be completely trusted (somebody could be listening - "sniffing" - your traffic). However, inside a LAN you're either connected via a cable or a Wi-Fi with encryption enabled, like if you're using WPA2 (if you're not using WPA2, enable it right now, not just because of this server!). Your connection will already be protected against eavesdroppers on a secure network, so you should be fine.

Third, that code you posted will indeed require authentication (using HTTP Basic Auth, which is fine for your use case), but it does not contain any code that lists the filesystem and allows exploring it.

To my knowledge, there's no pre-made utility similar to http-server that supports authentication out-of-the-box. You could hack your way around it, but it may just be much easier to use OSX's built-in file sharing tools (which are also safer and support different kinds of authentication). You can always use a simple app on your other devices - and you get full access to the file system, also in read/write!

1
  • Ya, I understand all that. I just wanted to see if I could add it so that roommates couldn't access it even if they knew the port and ip. I see your point of making it easier by using GUI apps to get it done... guess I should've said I've been doing that, but was looking for something more in-line that didn't require the installation/syncing of anything third party across devices. Thanks for the help, though!
    – YMGenesis
    Commented Aug 14, 2015 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.