Simple authentication mechanism

[rezrov]

Is there, or has it been already discussed, adding a simple authentication mechanism to the API? HTTPS with basic authentication would be adequate for most people I think.

[bbernhard]

Wouldn't a reverse proxy (with nginx or caddy) better suited for that? I haven't tried caddy yet, but what I've read so far is, that it is really easy to configure (unlike nginx, which is a bit more complex to set up). I think the great advantages of a dedicated server are:

• they already support all type of different authentication mechanisms. so in case someone wants to use something other than basic auth, there's probably already a integration for that.
• they are fast (and have some nice features like automatic ssl cert renewal already built in)
• they already take care of security vulnerabilities and zero days. Don't get me wrong, I am doing my best to keep track of any security related issues in the third party libs I am using and try to patch those as soon as I am aware of any issues. But by adding HTTPS support to the codebase, the potential attack surface gets a lot bigger.