Staticrypt is great! I extended it a bit so that it could be used to encrypt an entire website. Here are my steps:
- Change the template so that it stores the password in localStorage once entered.
- Run staticrypt on all html files.
- Now we have a website where the user can log in once and then navigate to other pages without entering in their password for each page. (demo at https://epicfaace.github.io/ghpages-private-test/, password is "password")
@robinmoisson would you be willing to accept PRs to modify staticrypt so that it can work with these kinds of workflows more easily? Essentially, staticrypt could then work out-of-the-box to let people easily deploy a password-protected github pages website (or, really, any static website).
I'm thinking of updating the staticrypt CLI options with the following parameters:
Usage: staticrypt <filename or directory> <passphrase> [options]
Options:
--help Show help [boolean]
--version Show version number [boolean]
-e, --embed Whether or not to embed crypto-js in the page (or use an
external CDN) [boolean] [default: true]
-o, --output File name / path for generated encrypted file
[string] [default: null]
-t, --title Title for output HTML page
[string] [default: "Protected Page"]
-i, --instructions Special instructions to display to the user.
[string] [default: null]
-f, --file-template Path to custom HTML template with password prompt.
[string] [default: "[...]/cli/password_template.html"]
-i, --in-place Whether to modify input file(s) in place.
-p, --persist-type Whether to persist the password in the user's browser.
Can be set to "localStorage", "sessionStorage", or "cookie".
[string] [default: null]
Then, generating a static site and deploying it to GitHub Pages might be as easy as doing the following:
npm run build # generates files in `dist`
staticrypt dist -i -p localStorage
gh-pages -d dist
Some potential improvements:
- It would be good to have an option such as
--logout-url that allows a logout page to be generated; the user can then link to this logout page on the static site which should clear the password from the user's localStorage / cookies.
- It seems okay, but not ideal, to store the plain password in the user's localStorage / cookies. Could we make the stored password automatically expire (if there's some cryptographic way to make a token valid only for a particular amount of time, that would be great -- otherwise, we could just maybe delete a cookie after a certain period of time)?
- Allowing provisioning of multiple users and passwords.
Related to #110, #114.
Staticrypt is great! I extended it a bit so that it could be used to encrypt an entire website. Here are my steps:
@robinmoisson would you be willing to accept PRs to modify staticrypt so that it can work with these kinds of workflows more easily? Essentially, staticrypt could then work out-of-the-box to let people easily deploy a password-protected github pages website (or, really, any static website).
I'm thinking of updating the staticrypt CLI options with the following parameters:
Then, generating a static site and deploying it to GitHub Pages might be as easy as doing the following:
npm run build # generates files in `dist` staticrypt dist -i -p localStorage gh-pages -d distSome potential improvements:
--logout-urlthat allows a logout page to be generated; the user can then link to this logout page on the static site which should clear the password from the user's localStorage / cookies.Related to #110, #114.