login control for self-hosted web client

[Surenthiran]

shlink-web-client version

3.10.2

How do you use shlink-web-client

Self-hosted

Summary

is there any way to add login page for using self hosted client? now it is directly opening and connecting to server without any authentication

[acelaya]

shlink-web-client is an app running 100% in the browser, and only your device knows about the API key, that's why it's safe to load server data with no user authentication, and at the same time, not possible to have end-user login.

This is somehow convenient, but presents some known limitations, that's why there is work in progress for a next-level Shlink app (AKA Shlink Dashboard) that will include its own backend, supporting user authentication.

See shlinkio/shlink-web-client#338 for details.

[Surenthiran]

I have a question about the design of shlink main server code. Why don't we include some APIs to create and authenticate users in the server code itself? This way, we can still have a backend-free client web app, but also have a user management module in the main server.

Is there any technical or architectural reason for not doing this? I would be happy to work on this feature if it is feasible and desirable.

[acelaya]

That would make Shlink handle a very specific responsibility which, from my point of view, should not be handled by it.

The architecture is explained here https://shlink.io/documentation/advanced/shlink-architecture/, and there's no plans to change it.

[Surenthiran]

Thank you for your feedback on the new expansion plans. I apologize for not reviewing that page before making my suggestions.

I agree that Shlink has a great design and that it should focus on its core functionality of shortening the urls.

This will allow it to scale infinitely and run smoothly on multiple instances.

However, I have one suggestion regarding the single instance and shared hosting users.

Since Shlink-Dashboard is still in early development, we could add a few more steps in the installation process of Shlink.

We could offer the option to install Shlink-Dashboard in a subfolder of the same server as Shlink, and also the option to use the same database or a separate one for it.

This way, we could accommodate more use cases without compromising the application architecture.

@acelaya

[mredodos]

@acelaya what i see with docker image after installarion anyone can access the web interface and anyone can go to the configuration of server or add or remove short links etc. is there no way to block or restrict access? Or I'm missing something?

[acelaya]

Anyone can access the app itself, but no one will have access to the servers you create in your device, because that's saved in the device's local storage.

[mredodos]

mmh..Actually i have send the link to my collegues and he can see and access to the server...

is possible because the api is in the server env?

[acelaya]

is possible because the api is in the server env?

Yes, that's the reason. It's VERY important that you don't use that feature with a public shlink-web-client instance, because you are exposing API keys publicly.

[maciejkrol18]

For anyone self-hosting with Coolify, the easiest solution is to modify the compose file and remove SHLINK_SERVER_API_KEY and SHLINK_SERVER_URL for the shlink-web image. This way there will be no server added by default in the web app and you'll have to add yours manually by entering the address set for the Shlink service in Coolify's interface and the API key from the environment variables.