Skip to content

Extension for encrypting an entire website #120

@epicfaace

Description

@epicfaace

Staticrypt is great! I extended it a bit so that it could be used to encrypt an entire website. Here are my steps:

  1. Change the template so that it stores the password in localStorage once entered.
  2. Run staticrypt on all html files.
  3. Now we have a website where the user can log in once and then navigate to other pages without entering in their password for each page. (demo at https://epicfaace.github.io/ghpages-private-test/, password is "password")

@robinmoisson would you be willing to accept PRs to modify staticrypt so that it can work with these kinds of workflows more easily? Essentially, staticrypt could then work out-of-the-box to let people easily deploy a password-protected github pages website (or, really, any static website).

I'm thinking of updating the staticrypt CLI options with the following parameters:

Usage: staticrypt <filename or directory> <passphrase> [options]

Options:
  --help               Show help                                       [boolean]
  --version            Show version number                             [boolean]
  -e, --embed          Whether or not to embed crypto-js in the page (or use an
                       external CDN)                   [boolean] [default: true]
  -o, --output         File name / path for generated encrypted file
                                                        [string] [default: null]
  -t, --title          Title for output HTML page
                                            [string] [default: "Protected Page"]
  -i, --instructions   Special instructions to display to the user.
                                                        [string] [default: null]
  -f, --file-template  Path to custom HTML template with password prompt.
                          [string] [default: "[...]/cli/password_template.html"]
  -i, --in-place   Whether to modify input file(s) in place.
  -p, --persist-type   Whether to persist the password in the user's browser.
                            Can be set to "localStorage", "sessionStorage", or "cookie".
                            [string] [default: null]

Then, generating a static site and deploying it to GitHub Pages might be as easy as doing the following:

npm run build # generates files in `dist`
staticrypt dist -i -p localStorage
gh-pages -d dist

Some potential improvements:

  1. It would be good to have an option such as --logout-url that allows a logout page to be generated; the user can then link to this logout page on the static site which should clear the password from the user's localStorage / cookies.
  2. It seems okay, but not ideal, to store the plain password in the user's localStorage / cookies. Could we make the stored password automatically expire (if there's some cryptographic way to make a token valid only for a particular amount of time, that would be great -- otherwise, we could just maybe delete a cookie after a certain period of time)?
  3. Allowing provisioning of multiple users and passwords.

Related to #110, #114.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions