starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Header-based authentication in lieu of mTLS #114

New Issue
Closed
opened 2025-12-29 01:23:26 +01:00 by adam · 0 comments
adam commented 2025-12-29 01:23:26 +01:00
Owner
Copy Link

Originally created by @ImpostorKeanu on GitHub (Jan 29, 2022).

Feature request

This is something I would happy assist/implement but I'd like to float the idea out there for feedback/alternatives before digging in.

Goal: Enforce authentication at the web API via administrator configured HTTP headers.

  • Headscale currently has the ability to enforce mTLS via certificate, but PKI is burdensome.
  • Perhaps an additional method of authenticating clients would be to allow one to set unique HTTP headers for client authentication: some-header=some-arbitrary-value.
    • Ideally, a unique header could be set on a per-node basis, akin to an API key.
    • The nodes subcommand could have an http-headers subcommand.
    • I haven't looked at Headscale's db schema yet but I suspect it'd be reasonably easy to accommodate storage of the headers.
  • Admittedly, Tailscale doesn't support custom HTTP headers at the moment, but that could likely be implemented with relative ease (all the assumptions).

Reason

The metrics endpoint, and potentially others, return information related to network nodes without enforcing authentication. I have a project that requires that these details be restricted to authorized users.

There's a lot of overhead with managing PKI, where management of unique HTTP headers can happen within Headscale itself.

Originally created by @ImpostorKeanu on GitHub (Jan 29, 2022). **Feature request** This is something I would happy assist/implement but I'd like to float the idea out there for feedback/alternatives before digging in. *Goal:* Enforce authentication at the web API via administrator configured HTTP headers. - Headscale currently has the ability to enforce mTLS via certificate, but PKI is burdensome. - Perhaps an additional method of authenticating clients would be to allow one to set unique HTTP headers for client authentication: `some-header=some-arbitrary-value`. - Ideally, a unique header could be set on a per-node basis, akin to an API key. - The `nodes` subcommand could have an `http-headers` subcommand. - I haven't looked at Headscale's db schema yet but I suspect it'd be reasonably easy to accommodate storage of the headers. - Admittedly, Tailscale doesn't support custom HTTP headers at the moment, but that could likely be implemented with relative ease (*all the assumptions*). **Reason** The metrics endpoint, and potentially others, return information related to network nodes without enforcing authentication. I have a project that requires that these details be restricted to authorized users. There's a lot of overhead with managing PKI, where management of unique HTTP headers can happen within Headscale itself.
adam added the enhancement label 2025-12-29 01:23:26 +01:00
adam closed this issue 2025-12-29 01:23:26 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#114
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?