Add authentication/authorization #2

New issue

Closed

opened 2026-03-05 06:21:24 +00:00 by Mark · 1 comment

Mark commented

2026-03-05 06:21:24 +00:00

Owner

The MVP currently has no authentication or authorization. Anyone can:

Upload games
Delete games
Access the upload form

Current state:

Documented as MVP limitation in README: "MVP has no auth. Put it behind a reverse proxy / VPN if needed."

Expected behavior:

At minimum, some form of access control
Could be basic HTTP auth, or simple password protection

Suggested approach for production:

Add simple password protection via environment variable
Or integrate with existing auth system
Document deployment behind VPN/reverse proxy with auth

The MVP currently has no authentication or authorization. Anyone can: - Upload games - Delete games - Access the upload form **Current state:** - Documented as MVP limitation in README: "MVP has no auth. Put it behind a reverse proxy / VPN if needed." **Expected behavior:** - At minimum, some form of access control - Could be basic HTTP auth, or simple password protection **Suggested approach for production:** 1. Add simple password protection via environment variable 2. Or integrate with existing auth system 3. Document deployment behind VPN/reverse proxy with auth

Mark commented

2026-03-05 06:47:32 +00:00

Author

Owner

This issue is still outstanding - no authentication has been added.

Current state: The app has no auth - anyone can upload/delete games.

Recommendation: For production deployment, use one of these approaches:

Deploy behind a reverse proxy (nginx, caddy, traefik) with built-in auth
Add simple password protection via environment variable
Use a VPN to restrict access entirely

This is working as intended for an MVP - documented in README.

This issue is still outstanding - no authentication has been added. **Current state:** The app has no auth - anyone can upload/delete games. **Recommendation:** For production deployment, use one of these approaches: 1. Deploy behind a reverse proxy (nginx, caddy, traefik) with built-in auth 2. Add simple password protection via environment variable 3. Use a VPN to restrict access entirely This is working as intended for an MVP - documented in README.