Repository navigation
Passphrase entry could be made skippable #815
Description
Some setups may not need a passphrase, e.g. when authentication was already taken care of (or in local/trusted environments). Currently, one would still have to provide some dummy passphrase and distribute that to everybody.
It would be very useful for such setups to be able to just skip passphrase/login altogether and have picoshare uploads be immediately available.
Activity
mtlynch commentedon Sep 28, 2026
Can you share a bit more about your scenario?
The design of PicoShare is one admin and many limited-access consumers. If there's no admin password, then anyone can delete or upload files, which may be fine in a trusted environment, but at that point, why use PicoShare over something like a shared network drive?
boogiewoogit commentedon Sep 29, 2026
Sure, consider something like https://github.com/oauth2-proxy/oauth2-proxy or similar, which can take care of authentication for a webapp via an external provider. Anyone accessing picoshare behind such a system would already be considered authenticated, so an option to remove the second layer of authentication would be quite useful.
The optimal solution on paper would of course be native oauth2/oidc login support in picoshare, but I guess there's a reason this hasn't been discussed on here yet, according to my search. And I think it does make sense to pass on that for a pointedly minimalist app.
mtlynch commentedon Sep 29, 2026
Ah, I see. Yeah, that's unfortunately out of scope at this point, as it's pretty complex to implement OIDC support. Maybe I'll do it someday though if I convert all my internal apps to OIDC, as I definitely see the value.
boogiewoogit commentedon Sep 29, 2026
I think you misread: this issue isn't about OIDC support! That's taken care of by oauth2-proxy. What I'm suggesting is really just an option to have no authentication in picoshare at all, concretely:
If
PS_SHARED_SECRET=="", then there is no login field, and assume everybody is logged in.With this, the experience can be much improved for setups using oauth2-proxy or similar. :-)
mtlynch commentedon Sep 29, 2026
I'm a bit confused. In your scenario, every user is admin of the PicoShare server?
boogiewoogit commentedon Sep 29, 2026
At least, every user is trusted to be able to upload, download and delete files freely, yes. Is there more to being logged in I'm missing?
mtlynch commentedon Sep 30, 2026
Yeah, I think the use case is just too far from what PicoShare is designed for. The assumption in the design is that there is a sole admin and everyone else is a low-privilege user.