live report.html chrome browser does not support credentials in url

[janneman001]

Very nice product you made, thanks for that.

I try to provide a live website report using the docker-compose setup with apache webserver, traefik and goaccess.
I set up a reverse proxy with basicauth for the website and also for the goaccess and this works well in i.e. firefox, safari but not with the chrome browser. I read that since chrome v59 credentials in url are not supported anymore.

My question is: how do i change goaccess.conf so it will use the headers to login to the websocket. I cannot find it in the documentation.

regards,
Jan

[allinurl]

Glad you found it useful!

Could you explain a bit more about what you mean with the credentials in the URL and how you're using them? I'm trying to get a better idea of what you're doing and what you're trying to achieve here. Thanks!

[janneman001]

I want to use the report with live updates. I don't want the live updates to be available without authentication. So i put the report behind basic auth and want the websocket to be as well.
Via goaccess.conf i chose: wss://user:pw@goaccessws.domain:443/path
However chrome browser objects. So i need the report.html js to put the user:pw in the header of the ws auth
I was looking for this configuration option in goaccess config but did not find it.

[allinurl]

Currently, there’s no way to pass those. It will need to be implemented, and I think we could handle it via the upgrade header. Maybe we could allow sending a JSON web token or let the user define the token? What are your thoughts? This might be a duplicate of #1133 and #2411.

[janneman001]

Thanks, yes that is what i was looking for. Also a way to configure it in, for example, goaccess.conf.

The basic auth for the report is to secure the secret used to access the websocket from unauthorized.
The basic auth for the websocket is to secure the real time data.
Basic auth on it own is pretty much useless without tls. That's why i handle both with the reverse proxy. In my case traefik.

It is not exactly a duplicate but the #1133 could work today if only the chrome browser still allowed it.
About #2411; basic auth/ tls does not need to be implemented within goaccess. Both could be outsourced to traefik/ngnix for example.

So the minimum requirement is the upgrade header and how to define it in the configuration via cli arg or file.

[janneman001]

Thinking a little further. If you implement authorization in the websocket service you could also add the secret/credentials to report.html during generation. This takes away some of the complextity from the implementation later.