Allow remote auth over HTTP

Author: pallyoung

README.en.md

@@ -172,7 +172,7 @@ For a publicly reachable deployment, the current build now includes:
 - `HttpOnly` session cookie
 - a `24` hour IP block after `3` failed passphrase attempts within `10` minutes
 - server-side single-root restrictions via `root.path`
-- HTTPS-required login for non-local hosts
+- public access over HTTP or HTTPS, with HTTPS reverse proxy still recommended
 
 Deployment details are documented here:
 

README.md

@@ -171,7 +171,7 @@ pnpm build:cli
 - `HttpOnly` session cookie
 - 同一 IP `10` 分钟内 `3` 次口令错误后封禁 `24` 小时
 - 基于 `root.path` 的服务端单根目录白名单
-- 对外访问时要求通过 HTTPS 反向代理提交口令
+- 支持通过 HTTP 或 HTTPS 对外访问，推荐在公网入口前使用 HTTPS 反向代理
 
 部署细节请看：
 

apps/server/src/auth/mod.rs

@@ -479,7 +479,6 @@ pub(crate) fn login(
     if !request.public_mode {
         return Ok((status_response(&auth.file, &request, true), String::new()));
     }
-    ensure_transport_allowed(&request)?;
     if !password_configured(&auth.file) {
         return Err(AuthFailure::new(
             StatusCode::SERVICE_UNAVAILABLE,
@@ -599,7 +598,6 @@ pub(crate) fn require_session(
         });
     }
 
-    ensure_transport_allowed(&request)?;
     let token = read_cookie_token(headers).ok_or_else(|| {
         AuthFailure::new(StatusCode::UNAUTHORIZED, "session_missing").clear_cookie()
     })?;
@@ -969,24 +967,14 @@ fn status_response(
         authenticated,
         password_configured: password_configured(file),
         local_host: request.is_local_host,
-        secure_transport_required: request.public_mode && !request.is_local_host,
+        secure_transport_required: false,
         secure_transport_ok: request.is_local_host || request.is_secure_transport,
         session_idle_minutes: file.session_idle_minutes,
         session_max_hours: file.session_max_hours,
         allowed_roots: file.allowed_roots.clone(),
     }
 }
 
-fn ensure_transport_allowed(request: &RequestContext) -> Result<(), AuthFailure> {
-    if request.public_mode && !request.is_local_host && !request.is_secure_transport {
-        return Err(AuthFailure::new(
-            StatusCode::BAD_REQUEST,
-            "secure_transport_required",
-        ));
-    }
-    Ok(())
-}
-
 fn request_context(
     headers: &HeaderMap,
     client_addr: SocketAddr,
@@ -1416,4 +1404,57 @@ mod tests {
         assert_eq!(effective_root_path(&file), None);
         assert!(file.allowed_roots.is_empty());
     }
+
+    #[test]
+    fn insecure_remote_public_mode_is_allowed_in_status_response() {
+        let file = AuthFile {
+            version: 1,
+            public_mode: true,
+            password: "demo-passphrase".to_string(),
+            root_path: "/srv/coder-studio".to_string(),
+            allowed_roots: vec!["/srv/coder-studio".to_string()],
+            bind_host: DEFAULT_BIND_HOST.to_string(),
+            bind_port: DEFAULT_BIND_PORT,
+            session_idle_minutes: DEFAULT_SESSION_IDLE_MINUTES,
+            session_max_hours: DEFAULT_SESSION_MAX_HOURS,
+            sessions: Vec::new(),
+        };
+        let request = RequestContext {
+            ip: "203.0.113.10".to_string(),
+            user_agent: "test".to_string(),
+            is_local_host: false,
+            is_secure_transport: false,
+            public_mode: true,
+        };
+
+        let status = status_response(&file, &request, false);
+
+        assert!(status.public_mode);
+        assert!(!status.authenticated);
+        assert!(!status.local_host);
+        assert!(!status.secure_transport_required);
+        assert!(!status.secure_transport_ok);
+    }
+
+    #[test]
+    fn remote_http_sessions_use_non_secure_cookies() {
+        let expires_at_ms = now_epoch_ms() + 60_000;
+        let insecure_request = RequestContext {
+            ip: "203.0.113.10".to_string(),
+            user_agent: "test".to_string(),
+            is_local_host: false,
+            is_secure_transport: false,
+            public_mode: true,
+        };
+        let secure_request = RequestContext {
+            is_secure_transport: true,
+            ..insecure_request.clone()
+        };
+
+        let insecure_cookie = build_session_cookie("token", expires_at_ms, &insecure_request);
+        let secure_cookie = build_session_cookie("token", expires_at_ms, &secure_request);
+
+        assert!(!insecure_cookie.contains("; Secure"));
+        assert!(secure_cookie.contains("; Secure"));
+    }
 }

apps/web/src/components/AuthGate.tsx

@@ -22,7 +22,6 @@ type AuthGateProps = {
 type AuthViewMode =
   | "sign-in"
   | "not-configured"
-  | "transport-required"
   | "blocked"
   | "unavailable";
 
@@ -310,16 +309,13 @@ export default function AuthGate({ locale, onSelectLocale, children }: AuthGateP
   }
 
   const blockedLabel = formatBlockedUntil(blockedUntil, locale);
-  const securityBlocked = status.secure_transport_required && !status.secure_transport_ok;
   const viewMode: AuthViewMode = !status.password_configured || errorCode === "auth_not_configured"
     ? "not-configured"
-    : securityBlocked
-      ? "transport-required"
-      : errorCode === "ip_blocked"
-        ? "blocked"
-        : errorCode === "auth_unavailable"
-          ? "unavailable"
-          : "sign-in";
+    : errorCode === "ip_blocked"
+      ? "blocked"
+      : errorCode === "auth_unavailable"
+        ? "unavailable"
+        : "sign-in";
 
   const inlineMessage =
     errorCode === "invalid_credentials"
@@ -330,9 +326,7 @@ export default function AuthGate({ locale, onSelectLocale, children }: AuthGateP
 
   const helperText = viewMode === "sign-in"
     ? t("authAllowedRootsHint")
-    : viewMode === "transport-required"
-      ? t("authSecureTransportRequired")
-      : viewMode === "blocked"
+    : viewMode === "blocked"
         ? t("authBlockedUntil", { time: blockedLabel || "—" })
         : viewMode === "unavailable"
           ? t("authUnavailable")
@@ -354,11 +348,6 @@ export default function AuthGate({ locale, onSelectLocale, children }: AuthGateP
     statusDescription = t("authNotConfiguredDescription");
     statusTone = "warning";
     showRetry = true;
-  } else if (viewMode === "transport-required") {
-    statusTitle = t("authTransportRequiredTitle");
-    statusDescription = t("authTransportRequiredDescription");
-    statusTone = "warning";
-    showRetry = true;
   } else if (viewMode === "blocked") {
     statusTitle = t("authBlockedTitle");
     statusDescription = t("authBlockedDescription", { time: blockedLabel || "—" });
@@ -416,7 +405,6 @@ export default function AuthGate({ locale, onSelectLocale, children }: AuthGateP
             <div className="auth-card-bar">
               <div className="auth-badge-stack">
                 <span className="section-kicker">{t("authPublicModeBadge")}</span>
-                {viewMode === "transport-required" ? <span className="auth-state-pill warning">HTTPS</span> : null}
                 {viewMode === "not-configured" ? <span className="auth-state-pill warning">auth.json</span> : null}
                 {viewMode === "blocked" ? <span className="auth-state-pill danger">IP</span> : null}
               </div>

docs/deployment/README.en.md

@@ -13,7 +13,7 @@ The current code supports:
 - a `24` hour IP ban after `3` failed passphrase attempts within `10` minutes
 - server-side single-root restrictions through `rootPath`
 - authentication on both `HTTP RPC` and `WebSocket`
-- HTTPS-required passphrase submission for non-local hosts
+- passphrase submission over either HTTP or HTTPS for non-local hosts
 - local access on `localhost`, `127.0.0.1`, and `::1` defaults to non-public mode
 - local access with `?auth=force` explicitly forces public mode
 
@@ -28,7 +28,7 @@ Recommended structure:
 Why this is recommended:
 
 - the application process does not terminate TLS itself
-- non-local login requires secure transport
+- HTTPS avoids sending the passphrase and session cookie over a clear-text network path
 - a reverse proxy is the right place for certificates, domains, and public ingress
 
 ## Configuration File
@@ -91,13 +91,13 @@ Recommended production values:
 That means:
 
 - the app only listens locally
-- all public traffic must come through an HTTPS reverse proxy
+- public traffic is easier to control through a reverse proxy
 
 If you explicitly want the process to listen beyond loopback, you can set:
 
 - `bindHost`: `0.0.0.0`
 
-But even then, public access should still sit behind an HTTPS reverse proxy because the app does not provide TLS directly.
+But even then, public access should still sit behind an HTTPS reverse proxy because the app does not provide TLS directly, and plain HTTP would expose the passphrase plus a non-`Secure` session cookie on the wire.
 
 ## Reverse Proxy Requirements
 
@@ -108,7 +108,7 @@ Your proxy should forward:
 - `X-Forwarded-For`
 - `X-Forwarded-Proto`
 
-`X-Forwarded-Proto=https` is especially important because the app uses it to decide whether secure transport is in place.
+If the proxy terminates HTTPS, keep forwarding `X-Forwarded-Proto=https` so the runtime can mark the returned session cookie as `Secure`.
 
 ## Caddy Example
 
@@ -150,7 +150,7 @@ server {
 3. Set the access passphrase
 4. Override `rootPath`, `bindHost`, or `bindPort` only if you need non-default values
 5. Start or restart the app
-6. Configure an HTTPS reverse proxy to `bindHost:bindPort`
+6. Configure a reverse proxy to `bindHost:bindPort` as needed, with HTTPS still recommended for public ingress
 7. Open your domain and verify the login screen appears first
 
 Minimal setup:

docs/deployment/README.md

@@ -13,7 +13,7 @@
 - 同一 IP 在 `10` 分钟内连续 `3` 次口令错误后，封禁 `24` 小时
 - `rootPath` 服务端单根目录白名单
 - `HTTP RPC` 与 `WebSocket` 同时鉴权
-- 非本地访问时要求通过 HTTPS 提交口令
+- 非本地访问时允许通过 HTTP 或 HTTPS 提交口令
 - `localhost` / `127.0.0.1` / `::1` 访问时默认走非 public mode
 - 本地访问时如果 URL 带 `?auth=force`，则强制走 public mode
 
@@ -28,7 +28,7 @@
 推荐这样做的原因：
 
 - 应用进程本身不做 TLS 终止
-- 对外登录默认要求安全传输
+- HTTPS 入口可以避免口令和 session cookie 以明文经过网络
 - 反向代理更适合处理证书、域名和公开入口
 
 ## 配置文件
@@ -91,13 +91,13 @@
 这表示：
 
 - 应用只监听本机
-- 对外流量必须先经过 HTTPS 反向代理
+- 对外流量更适合先经过反向代理
 
 如果你明确知道自己在做什么，也可以改成：
 
 - `bindHost`: `0.0.0.0`
 
-但即使这样，公网访问也仍然建议放在 HTTPS 反向代理后面，因为应用本身不直接提供 TLS。
+但即使这样，公网访问也仍然建议放在 HTTPS 反向代理后面，因为应用本身不直接提供 TLS，而且 HTTP 会让口令和非 `Secure` cookie 暴露在明文链路上。
 
 ## 反向代理要求
 
@@ -108,7 +108,7 @@
 - `X-Forwarded-For`
 - `X-Forwarded-Proto`
 
-其中 `X-Forwarded-Proto=https` 很关键，因为应用会用它判断当前是否为安全传输。
+如果代理层已经做了 HTTPS，建议继续透传 `X-Forwarded-Proto=https`，这样运行时返回的 session cookie 会自动带上 `Secure` 属性。
 
 ## Caddy 示例
 
@@ -150,7 +150,7 @@ server {
 3. 设置访问口令
 4. 如有需要，再覆盖默认的 `rootPath`、`bindHost`、`bindPort`
 5. 启动或重启应用
-6. 配置 HTTPS 反向代理到 `bindHost:bindPort`
+6. 按需要配置反向代理到 `bindHost:bindPort`，公网入口推荐使用 HTTPS
 7. 打开你的域名，确认先出现登录页
 
 最小可用配置：