Storybook: Secure the main view

[chulanovskyi]

Is it possible to have any sort of authorization to the Storybook, for example to create initial login page (simple name&pass component) and wrap the main Storybook app with it to ensure that user have an access to the view.

I've been searching for any examples or at least a described approach how it could be achieved, but found none. I thought that it might be at the addons - still no luck.

[sensone]

Me also interested this question

[chulanovskyi]

The question remains opened

[chulanovskyi]

Don't close

[ndelangen]

@chulanovskyi If you're creating a static build the security should be provided on a hosted level.

If you're running a dev server, we could add some login, but that's a little out of scope for what it is: a dev setup.

Having said that, We have made improvements to make the dev-server more composable "under the hood" and so if we up the documentation you'll likely be able to wrap storybook's dev server with another express server which has auth fairly easily.

Improving docs is high on my priority list. So it's coming.

[stale[bot]]

Hi everyone! Seems like there hasn't been much going on in this issue lately. If there are still questions, comments, or bugs, please feel free to continue the discussion. Unfortunately, we don't have time to get to every issue. We are always open to contributions so please send us a pull request if you would like to help. Inactive issues will be closed after 30 days. Thanks!

[stale[bot]]

Hey there, it's me again! I am going close this issue to help our maintainers focus on the current development roadmap instead. If the issue mentioned is still a concern, please open a new ticket and mention this old one. Cheers and thanks for using Storybook!

[evankellogg]

Hello, was the documentation ever updated to show to how wrap the dev server in a separate express server?

[chulanovskyi-bs]

@evankellogg I've just looked through their new _fancy_ guides, and guess what - not a single word about security, neither at main docs...

[ndelangen]

We assume the dev server is used development on someone's local machine and that will never be made public.

We assume the static build could be hosted anywhere, and pretty much all hosting platforms have some way to add a basic auth to a folder or something.

Here's our start-dev script:
https://github.com/storybookjs/storybook/blob/next/lib/core/src/server/build-dev.js

This is where it's used in a framework app:
https://github.com/storybookjs/storybook/blob/next/app/react/src/server/index.ts