Visdom: Feature Request: please support some authentication method

[hfarazi]

It would be really useful to support some http authentication method (login page)

[meetshah1995]

@JackUrb - I'm willing to send in a PR for this.

Any pointers on where I can start and what you have in mind for this auth feature?

[lvdmaaten]

I have never tested it, but I think you would have to replace the main() function in server.py by something like:

app = Application()
http_server = tornado.httpserver.HTTPServer(app, ssl_options={
    "certfile": FLAGS.https_cert_file,  # something like "/path/to/ca.csr"
    "keyfile": FLAGS.https_key_file,    # something like "/path/to/ca.key"
})
http_server.listen(FLAGS.port, max_buffer_size=1024 ** 3)
logging.info("Application Started")
if "HOSTNAME" in os.environ:
    hostname = os.environ["HOSTNAME"]
else:
    hostname = "localhost"
if print_func is None:
    print("You can navigate to https://%s:%s" % (hostname, FLAGS.port))
else:
    print_func(FLAGS.port)
tornado.ioloop.IOLoop.instance().start()

(Note that this isn't a complete PR --- the server should only specify ssl_options if the user specified both a certificate and a key file, and similarly the printed URL should say http:// or https:// depending on the input arguments.)

[JackUrb]

@lvdmaaten That process seems a little more related to https://github.com/facebookresearch/visdom/issues/148 than here, I feel the original intent of the feature request is more just a 'login' page of sorts to ensure that people aren't getting access to the Visdom page if they don't have the credentials.

@meetshah1995 As far as where to start and what I had in mind (though it's still somewhat rough) is having a flag when running the server to set up a username and password. If that flag is set then when starting the server at https://github.com/facebookresearch/visdom/blob/4cbe32f740f2b09980c834f39d4da779ba5c4cf3/py/server.py#L739 the username and password can be requested. The SHA of the password should be stored rather than the pass itself.
From that point the main changes come up in the IndexHandler of the server: https://github.com/facebookresearch/visdom/blob/4cbe32f740f2b09980c834f39d4da779ba5c4cf3/py/server.py#L634
If the auth flag had been set, the functionality will need to change slightly (though it should remain exactly as it is otherwise). You can create a simple HTML file for the login page (if you make it nicer than simple that's cool too) and serve that for any get requests. That page should request a username and password and could post them to the same address. For post requests you should make it check the username and password and either render a login page with "incorrect login" if the credentials aren't right and the regular visdom page that currently gets rendered if they are.

[rubiagatra]

I'll check this one out

[JackUrb]

@rubiagatra let me know if you have any questions!

[rubiagatra]

Where the user save username and password @JackUrb ?, It will hardcoded?

[JackUrb]

It shouldn't be hardcoded. As described above in https://github.com/facebookresearch/visdom/issues/85#issuecomment-354812408, the server should take an option to need username/password verification. After that point when the server is starting up, if that flag is set it should _ask_ the user for a username and password combination.

The flag can be gotten from the command line arguments, which are parsed here: https://github.com/facebookresearch/visdom/blob/4cbe32f740f2b09980c834f39d4da779ba5c4cf3/py/server.py#L44

[rubiagatra]

I see, so when we start a server with the flag, we will be asked username and password. Instead of plain password we save it with SHA?. Correct me If I am wrong. This is my first time to try to contribute 🙇 @JackUrb

[JackUrb]

Yup that's about what I'd be expecting!

[rubiagatra]

Thanks! @JackUrb , I am trying to tackle it right now.

[rubiagatra]

Hello, @JackUrb this is my idea for authentication method https://github.com/facebookresearch/visdom/pull/330. This PR is my rough idea, and I need your feedback

[JackUrb]

Thanks @rubiagatra for implementing this in #330!