On Air passphrase protection - how it works?

[MicaelJarniac]

Hi!
I'm considering sponsoring for the nice On Air features, including the passphrase protection, but I wanted to know how it works first, and how safe it is.

[evnchn]

Hello @MicaelJarniac. It's you again!

I don't know how NiceGUI On Air password protection works, but I can't see how it's screw-up-able.

It's just basic server authentication. Password correct, let stuff through. Password incorrect, eat dust.

As long as you don't send the password in a way that may be interceptable and replayed, it should be fine.

Maybe let's get @rodja to explain in a deeper level, if he's comfortable with it.

[rodja]

We are appy that you consider using NiceGUI On Air. The passphrase implementation is quite similar to https://github.com/zauberzeug/nicegui/blob/main/examples/authentication/main.py. But instead of a username we use the url path to identify the right database entry. What are your criteria @MicaelJarniac?

[MicaelJarniac]

My use case is, I have a dashboard connected to some sensitive service, and I'd like to use On Air to share the development version with coworkers, before we deploy the final version.

Since it's connected to a sensitive service, I'd like On Air to only be accessible by them, and no one else.

Also, the idea is to sponsor from the company's GitHub. How does that work? Will I have access to the On Air configuration using my personal GitHub since I'm a member of the company?

[falkoschindler]

@MicaelJarniac Regarding the sponsoring: Currently you need to use the same GitHub login which is sponsoring NiceGUI to get benefits like password protection for your devices. But we're working on a feature that allows the owner of an On Air organization to add other members via GitHub username. Would this help in your use case? Then the sponsoring GitHub user would need to login into On Air once and invite other members of the company.

Note that this refers to the On Air backend at https://on-air.nicegui.io/ where you manage your project. To access your running app you only need a password, no GitHub account whatsoever.

[MicaelJarniac]

What if someone sponsors as an organization, not as a user? Will they not have access to the benefits, then?

And yeah, the option to add other members would certainly help.

[falkoschindler]

Oh, good point. Currently we check if the logged-in GitHub user is sponsoring. Considering the user's organization to be a sponsor would be a new feature we need to think about.