Auth Logs and File Upload Type Restrictions

[QVBU]

Hi,
this is a very interesting project. I’ve been looking for a similar project for a long time. Many thanks to the developers, but any way.
I’m trying to test gokapi-linux_amd64 + nginx proxy locally on a VM. I have a few questions if anyone can help :). In the web GUI, in the logs, when I apply the 'auth' filter, the logs are empty, even if I enter an incorrect username/password beforehand. For example, how to check brute force?
I understand that the best way to use it is with basic nginx auth, but...
How can I limit the upload by file type? For example, allow only PDF files. The nginx config is set to:

    location /uploadChunk{
        set $is_pdf 0;
        if ($request_uri ~* \.pdf$) {
            set $is_pdf 1;
        }

        if ($is_pdf = 0) {
            return 415 "Unsupported Media Type";
        }

        proxy_pass http://127.0.0.1:53842;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

but no matter which file is uploaded, I get a 415 error."
Thanks for help.

[Forceu]

Hi thanks for the feedback!
There is indeed no log entry for a failed login attempt, but it would probably be a good idea to add. At the moment there is a delay (I think 2 or 3 seconds) when entering an incorrect password, but this is only for the current request, so brute forcing requires more resources, but is still possible.

I was thinking of either one of these:

• Implementing a increasing delay after 3 failed attempts for all sessions
• Adding a captcha
• Banning an IP
• Locking an account (however that could be used maliciously)

Regarding the file type restrictions: This is currently not possible. The only way would be to filter requests to /api/chunk/complete and check the filename header (see also API documention: The filename of the uploaded file. If the filename includes non-ANSI characters, you can encode them with base64, by adding 'base64:' at the beginning, e.g. 'base64:ZmlsZW5hbWU=')

Filtering has also then be done with /api/files/add, where the file can be uploaded with a multipart body.

Obviously this is a bit too much, so I might implement a feature to disallow certain extensions. Out of interest, what is your reason for requiring this?

[QVBU]

These three options would be ideal:

• Implementing an increasing delay after 3 failed attempts for all sessions
• Adding a CAPTCHA
• Banning an IP

As for your question, our motto is: drop everything that isn't being used. :)
Thanks.

[QVBU]

For the implementation of a limit for brute force, you can use:
limit_req zone=login_limit burst=xxxx nodelay;
along with fail2ban. However, it’s still better to wait for the developer's implementation with logs ;).

Maybe someone can help me.
I'm trying to set up a security layer to prevent bots etc.
I set up basic auth for the server block in Nginx, but I’m trying to disable basic auth for the downloads URL path.
Here is an example of the config:

server { 
    ....
    ....

    location / {

    # Basic Auth
        auth_basic "some area";
        auth_basic_user_file /etc/nginx/../auth;

    # Proxy settings
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:53842;
    }


    # Disable Basic Authentication for the /d/ location (downloads)
    location /d {

        auth_basic off;

    # Proxy settings
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:53842;
    }
}

This doesn't work correctly. The pop-up alert still appears. If you click 'Cancel', there’s no 401 error, and the file can be downloaded, but the CSS styles is missing. See the the photo below.

PS some people prefer local authentication over Google OAuth 2.0, etc.

Anyway, the idea of building this simple, self-hosted file-sharing server is great—no extra features, nothing unnecessary. :)

Thanks for help.

[QVBU]

Maybe these solutions will help someone resolve issues with downloading files without basic auth in Nginx.

    # Disable Basic Authentication for the /d/ location (downloads)
    location /d {
        auth_basic off;
  
    # Proxy settings
        include /etc/nginx/path/to/proxy_params;
        proxy_pass http://127.0.0.1:53842;
    }

    # Assets required by the /d page
    location ^~ /assets/ {
        auth_basic off;

    # Proxy settings
        include /etc/nginx/path/to/proxy_params;
        proxy_pass http://127.0.0.1:53842;
    }

    location ^~ /css/ {
        auth_basic off;

    # Proxy settings
        include /etc/nginx/path/to/proxy_params;
        proxy_pass http://127.0.0.1:53842;
    }

    location ^~ /js/ {
        auth_basic off;

    # Proxy settings
        include /etc/nginx/path/to/proxy_params;
        proxy_pass http://127.0.0.1:53842;
    }