How to authenticate external auth HTTP client?

[sergejostir]

Hello.

I am currently using external auth with providing a shell script which then makes HTTP request to my external server to confirm user credentials. I am thinking about getting rid of this script and using the integrated http client to make the request directly. Looking at the docs, I haven't found a way how to authenticate sftpgo's http client at my external server then (is there a way to include auth header?). I could include credentials in the URL, but doesn't seem like a good idea since they will be saved in logs.

[drakkan]

Hi,

I'll try to redacted the credentials so they will not appear in logs

[sergejostir]

I meant the logs on the receiving end. Anyway, I think I can solve this by generating random credentials every time sftpgo is started and including them in url's query.

[drakkan]

This is strange generally only the username is logged

[sergejostir]

I think that most of the webservers log request URIs by default and querystring is part of the URI. That's why the headers are normally used for passing secrets because those are normally not logged.

[drakkan]

Hi,

I think you are wrong, please try to configure an hook such as this one within sftpgo.json:

"actions": {
      "execute_on": ["upload"],
      "hook": "http://nicola:[email protected]/notifications"
    },

after an upload I get this apache log:

127.0.0.1 - nicola [08/May/2021:19:37:56 +0200] "POST /notifications HTTP/1.1" 200 -

as you can see only the username is logged. If you put the credentials inside the query string they will logged from your webserver.

The SFTPGo http hooks support basic auth (embedding the credentials within the URL) and client certificate authentication

[sergejostir]

I forgot about the basic auth. Thanks!