Generated with `npm init nodets@0.0.0`.
npm install @wiser/lockdownGenerated with npm init nodets@0.0.0.
This project is used to add a HTTP authentication lock screen to a React application.
The purpose of this repository is to control access to DEV and UAT websites that are under development. The scope is simple brand management. This is not real security!
> ⚠️ This project is not application security! It should only be used for simple brand protection, but not to secure important information!
server.js file.``bash`
npm install --save @wiser/lockdown
`js
const { createServer } = require("http");
const { parse } = require("url");
const next = require("next");
const dev = process.env.NODE_ENV !== "production";
const app = next({ dev });
const handle = app.getRequestHandler();
const routes = [ ];
app.prepare().then(() => {
createServer(async (req, res) => {
const parsedUrl = parse(req.url, true);
const { pathname, query } = parsedUrl;
for (let route of routes) {
if (!!pathname.match(route.path)) {
await route.ctrl(req, res);
return;
}
}
// This is where we add lockdown's accessCheckOk function
if (!accessCheckOk(req, res)) {
return;
}
handle(req, res, parsedUrl);
}).listen(3000, (err) => {
if (err) throw err;
console.log("> Ready on http://localhost:3000");
});
});
`
Access management is done through environment variables. Setting LOCKDOWN_ACL with a list of user:pass strings, delimited by a comma. This will grant access to the username user providing the password pass, also providing access to any other username and password combinations provided in the list.
`bash`
LOCKDOWN_ON=true
LOCKDOWN_ACL="hello:world,user:pass,abc:xyz"
> This is not a substitute for IAM or application layer user management! You will be hacked if you use this!
Once they're logged in, they will be allowd to access the requested page