/-/open-csv-file etc APIs should be authenticated and only accept calls from the Electron wrapper script about datasette-app HOT 4 CLOSED

In #52 I want an option to open up the server to the whole network, but I don't want anyone on the rest of the network being able to open arbitrary files.

from datasette-app.

I think the way to do this is with a Bearer token - but how should that secret be established and shared with the server?

I think the Electron server generates a random secret and sets it as an environment variable - then the Python server can see that variable and compare it to a Bearer header sent by Electron.

from datasette-app.

This works:

let token = require("crypto").randomBytes(32).toString("hex");

from datasette-app.

Token is now being generated and passed to the Datasette server - next step is to upgrade the plugin to only accept calls if they are accompanied by a Bearer token that matches the DATASETTE_API_TOKEN environment variable.

from datasette-app.