Giters

darklynx / request-baskets

HTTP requests collector to test webhooks, notifications, REST clients and more ...

Home Page:https://rbaskets.in

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Configurable password to protect buckets and shareable link buckets

nextrevision opened this issue · comments

commented

Would be great to configure a password after creating a bucket, replacing the token created with the bucket, to have a shareable password. In addition, it would be nice to be able to share buckets with a link that would not require a password or token.

commented

The idea behind generation of access token for a basket versus creator of the basket explicitly define an access credentials was to avoid weak credentials protecting the sensitive data collected by basket, it also fits well to the original concept of unit/integration tests described in the issue #26:

  • basket gets created at the test run and stores the generated token
  • tests are monitoring HTTP requests collected by basket and validate the logic covered by test suite
  • during tire down (after suite) logic basket is deleted
  • even if basket is not deleted, it is secured with a strong token

You can even share the source code of such tests w/o a fear that somebody can access the data collected during testing (basket credentials wont leak).

I believe you have a different use cases for the Request Baskets service :).

Can you please describe a bit more the password logic: is it an alternative authentication to the generated access token that temporary allows somebody else to access the basket and can be revoked after, or do you suggest to replace the original token with custom credentials (maybe even allow to supply them while basket is created)?

Second idea can be simply implemented by adding access token as a query parameter when opening basket web UI, e.g. https://rbaskets.in/web/mydemobasket?token=jg321h....

commented

I think I'm starting to understand the intended workflow a bit better now. I'm currently using Request Baskets for troubleshooting/debugging API calls made by blackbox services and persistent API mocking. In the troubleshooting case, I want to be able to view the request and let others see it as well. Passing along the token may be enough in that case to enable that.

commented

This can be quickly implemented on the front-end side w/o any changes in service API. It is probably even make sense to add a button "share this basket" that copies such a link into clipboard.

commented

implemented in a simple way as we discussed above: basket access token is passed as a query param and accepted by the UI, button is added in the basket menu to generate a link to share the basket