[Feature request] Secure comet with password

[marco-calautti]

Since stremio requires addons to be over https and with a proper domain, we are mostly forced to make our comet instance public. At the moment, there is not security that prevents unauthorized users to use your public come instance. I think adding a password filed where the user is required to input the proper password in order for the link to work would be very useful.

[Zaarrg]

@marco-calautti
Not quite sure if i understand this correctly. But a password to input on the config page, similar to the debrid stream proxy password?

Because if you are worried about the config page being public u can by using for example nginx ip whitelist it or add basic auth. This way the browser will prompt u to enter username and password when using the config page.

Personally i use nginx proxy manager and have basic auth setup on /comet/....../config using the location " ~ ^/[^/]+/configure$ "
and " = /comet/configure " .

This way i got basic auth on only the config page.
Plus using the TOKEN env for comet-uncached to encrypt the config in the url

Sadly more secure then this it wont get. If stremio would support passing auth credentials then auth could be implemented directly into the comet api which would be the most secure as this would only give the stremio app access.

The worse thing the above setup that could happen is someone using your encrypted link to add the addon and watch stuff. But for this they would need the link.
Only way to secure even this is a ip whitelist / access list as of my knowledge.

[marco-calautti]

I tried both solutions. IP whitelisting is not very useful when the comet service is public with a domain, since I would need to whitelist my own WAN IP, which is dynamic. For basic auth I tried, but as you said, stermio does not support basic auth.

Am I right to say that since we use HTTPS, the whole url is encrypted and put in the HTTPS payload, and thus, we only leak the comet domain name, when using the addon?
If this is the case, your solution with basic auth over the config page seems good enough to me.

[marco-calautti]

Another option, that could even avoid the basic auth, is let the reverse proxy serve only on urls of the form <domain>/*/manifest.json. This would work well for people using a VPN, or who are fine configuring comet from their local network.

[Zaarrg]

I tried both solutions. IP whitelisting is not very useful when the comet service is public with a domain, since I would need to whitelist my own WAN IP, which is dynamic. For basic auth I tried, but as you said, stermio does not support basic auth.

Am I right to say that since we use HTTPS, the whole url is encrypted and put in the HTTPS payload, and thus, we only leak the comet domain name, when using the addon? If this is the case, your solution with basic auth over the config page seems good enough to me.

Yeah that is basically the case.
Only thing visible is the domain as it is needed for DNS resolution.
So in the case of mydomain/encryptedconfig/video.mp4 the URL path and query parameters aswell as the payload are encrypted while traveling using https.
Only if someone has the whole url the encryptedconfig would get exposed. But in that case without the Token env its worthless.

Another option, that could even avoid the basic auth, is let the reverse proxy serve only on urls of the form /*/manifest.json. This would work well for people using a VPN, or who are fine configuring comet from their local network.

Yeah that is also a nice solution.
For my setup i just use cloudflare + token env for encrypted config + the /config webui with restricted access, ip access list.
I find this to be enough for me. And if i want to give access to friends i just setup the config on the webui for them and send them the link to add to stremio.

Will definitely still look for options to make it more secure or add some kind of option to make sure requests come only from stremio.
Because with stremio web it would be possible to add basic auth to the requests sent for addons cause it is open source. But stremio web still has problems with their player and transcoding.
Also what i did quite some time ago was mod the server.js used for the stremio server to add basic auth support.

But sadly those are just hacky/mod ways that break after one update nothing proper.