Add an optional authentication mechanism to the MJPEG stream #1

New issue

Closed

opened 2026-05-11 06:12:31 +00:00 by Mark · 0 comments

Mark commented

2026-05-11 06:12:31 +00:00

Owner

Problem

The daemon binds to 0.0.0.0:PORT, exposing the camera stream to anyone on the network. There is no authentication or access control.

Suggested Solution

Add an optional authentication mechanism:

Simple option: Support a WEBCAM_PASSWORD env var; if set, require a password query parameter or basic auth on /stream.
Robust option: Use Flask tokens or a configurable shared secret.

This is a security hardening task — the current behavior is fine for trusted LANs, but users should have the option to restrict access.

Acceptance Criteria

/stream (and ideally / and /health) require some form of auth when configured
Auth is disabled by default (no breaking change)
Documented in README and the service file commented env vars

## Problem The daemon binds to `0.0.0.0:PORT`, exposing the camera stream to anyone on the network. There is no authentication or access control. ## Suggested Solution Add an optional authentication mechanism: - **Simple option**: Support a `WEBCAM_PASSWORD` env var; if set, require a password query parameter or basic auth on `/stream`. - **Robust option**: Use Flask tokens or a configurable shared secret. This is a security hardening task — the current behavior is fine for trusted LANs, but users should have the option to restrict access. ### Acceptance Criteria - [ ] `/stream` (and ideally `/` and `/health`) require some form of auth when configured - [ ] Auth is disabled by default (no breaking change) - [ ] Documented in README and the service file commented env vars