Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added support for HTTPS client certificate authentication #4722

Open
wants to merge 3 commits into
base: dev
Choose a base branch
from

Conversation

leogcurvelo
Copy link

@leogcurvelo leogcurvelo commented Mar 23, 2025

WHY

While a proxy of "http" type can be protected by "httpUser" and "httpPassword", no such protection is provided for "https" proxies. This leaves them unprotected in case someone guesses the URL, the URL leaks, or someone looks over your shoulder; as a system administrator, you would want to put yet another reverse proxy in front of the service to protect it, or if possible modify the actual service to ask for username and password.

This lack of support for HTTP Basic Authentication on HTTPS proxies has been talked about as a technical limitation:
#3242 (comment)
And due to my novice skills in Go, I took that to heart and didn't even think of intercepting the encrypted connection, so I turned to the next best thing: HTTPS client certificate authentication, which is done at the TLS configuration level.

This PR adds a new "clientCertificates" configuration to "https2http" and "https2https" plugins, as such:

[[proxies]]
name = "web"
type = "https"
customDomains = ["test.example.com"]

[proxies.plugin]
type = "https2http"
localAddr = "127.0.0.1:80"
crtPath = "server.crt"
keyPath = "key.pem"
clientCertificates = ["authorizedClient1.cert"]

Multiple, self-signed, certificates can be set in this configuration, and at least one of them will be required to access the service. The client certificate can normally be installed at system-level or at application-level, at the discretion of the user.

Below is a demonstration of the feature using the Vivaldi browser, with a self-signed certificate installed at system-level:
frp_demo.webm

While this form of authentication is not common like Basic Authentication, it does provide security benefits, and I think they're worth considering as well:
https://en.wikipedia.org/wiki/Mutual_authentication#Defenses

Finally, I have updated the README to reflect these changes with instructions; and created two new e2e tests, separate from the existing https2http and https2https tests, specifically for client certificate authentication.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant