Add support for mTLS / client TLS certificates

オープン
  • 何か問題がありますか？
#646 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
42/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
静か
技術スタック
csharp
領域
backend, security

調査の方向性

The change belongs where the HttpClient used to call the Immich API is constructed; the issue suggests configuring a custom HttpClientHandler with ClientCertificateOptions and ClientCertificates, or using a named client from IHttpClientFactory. Start by finding that construction point and deciding how certificate settings reach it. Done means a configured client certificate is presented on Immich requests, with a test or manual check against an mTLS-protected Immich instance. The issue has no maintainer reply, so confirm the configuration design first.

索引モデルが issue の本文から書いたものです。

説明

enhancement
Description

A common way to harden services exposed to the internet is to use mTLS. Such a setup requires clients to be in possession of a valid certificate in order to be allowed to communicate with the server.

This adds an additional layer of security comparable to using a VPN, e.g. preventing untrusted clients from abusing vulnerabilities in hosted applications. While the official Immich app already supports mTLS, it'd be great if ImmichFrame did so too, when it comes to querying Immich's API.

Use Case
Details

A common way to harden services exposed to the internet is to use mTLS. In a regular TLS setup, it is only the server which is in possession of a certificate, which it uses to prove to the client that it is who it claims to be. In mTLS, the client must also present a TLS certificate, deemed valid by the server, in order to be allowed to communicate with the server at all.

This provides an added layer of security, similarly to using a VPN, where e.g. potential vulnerabilities in a service's built-in authentication cannot be exposed by untrusted clients all over the web. Support for mTLS has been added to the official immich app ~two years ago. On the server side, this functionality is supported by the vast majority of reverse proxies, such as nginx, Traefik or caddy.

It'd be great if support for mTLS could be added to ImmichFrame, so that it can be used in conjunction with a such-secured Immich setup. To clarify this would be about ImmichFrame acting as a client towards the Immich API, and not about the ImmichFrame app when connecting to the ImmichFrame backend.

In the .NET world, this seems to be supported by instantiating one's HttpClient using a custom HttpClientHandler, on which one sets the ClientCertificateOptions and ClientCertificates properties.

Defining a custom handler is also supported by factories implementing IHttpClientFactory, although that seems to require a brief detour via a 'named' HTTP client.

Pre-Submission Checklist

  • This is a feature request and not a bug report

  • I have checked for related issues and checked the documentation

主要言語
C#
スター
2.4k
フォーク
121
平均マージ
18日 20時間
マージ済み PR（30日）
1

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

immichFrame/ImmichFrame のほかの issue

immichFrame/ImmichFrame の issue をすべて見る

似ている issue

C# の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。