Kue: Cannot Secure Kue

[digitaljohn]

We used to secure Kue with something like this:

var app = express();
app.use(express.basicAuth(config.kue.username, config.kue.password));
app.use(kue.app);

var port = config.production ? 21 : 8002;
app.listen(port);

This no longer works and the browser just hangs trying to connect.

[behrad]

master branch has problems since my last commit, fixed this... will push soon

[ItalyPaleAle]

By the way, we in production secure Kue at the Nginx level, adding also SSL and HTTP Basic Auth :) Just my two cents, maybe this can help you too!

[endorama]

I think this is related to the fact that express 4 has no basic-auth middleware by default.

If you need a quick workaround I followed this guide to have basic authentication and it works :) https://davidbeath.com/posts/expressjs-40-basicauth.html

[behrad]

@endorama I should update related section in docs? right?

[digitaljohn]

I did use the new middleware as it's not included with express 4. That's when it hangs. Just a fails to load the page.

[endorama]

Would you mind trying the code in the link I posted above? That code is working correctly for me ( with npm package )

Are you using npm version of kue (0.8.12) or master?

[digitaljohn]

I implemented that method exactly but still hangs. On a side note, when I remove auth protection it tried to redirect to http://active/

And I am using 0.8.12

[endorama]

I'm experiencing the same problem, I didn't notice that.

To reproduce:

• use kue app in a express application:

```
var app = express();

app.use(kue.app);

app.listen(3000);
```

• try to reach localhost:3000

This does not seems related to securing the kue admin ui, as in my case is happening also when no securing is performed. I'm going to open a new issue for this.

@digitaljohn as a workaround you should be able to reach the admin ui directly via url like this: http://localhost:3000/inactive. Accessing the url directly is working for me.

[endorama]

By the way: npm package (8.1.2) does not require express 4, so my first comment is "wrong" :)
My workaround and the link posted should work both for express 3 and 4 I think, as is only a simple middleware.
Maybe the problem reported by @digitaljohn is not related to express version as I first suggested?

[vicatcu]

This project is great, thanks! In case it helps anyone I got this working on Ubuntu 16.04, with the following in my package.json dependencies.

    "basic-auth": "^1.0.4",
    "express": "^4.14.0",
    "kue": "^0.11.5"

Note: I have set this up with Nginx, set up with LetsEncrypt for SSL, as a reverse proxy port 3333. If you don't ride it on an encryption layer (like SSL), Basic Auth is trivially insecure. I'm not going to try to address what it takes to set that up in this comment, but here are two useful pointers.

var kue = require('kue');
var basicAuth = require('basic-auth');
var express = require('express')
var app = express()

var auth = function (req, res, next) {
  function unauthorized(res) {
    res.set('WWW-Authenticate', 'Basic realm=Authorization Required');
    return res.send(401);
  };

  var user = basicAuth(req);

  if (!user || !user.name || !user.pass) {
    return unauthorized(res);
  };

  if (user.name === 'admin' && user.pass === 'password') {
    return next();
  } else {
    return unauthorized(res);
  };
};

app.use(auth);
app.use(kue.app);
app.set('title', 'My Application');
app.listen(3333);