Enhance security by protecting the shutdown
Closed this issue · 7 comments
To my knowledge, the /endpoint/shutdown is hardcoded. How can this be changed, so a shutdown can be set to any URL AND needs a password or token? Currently, if someone knows I am running this module, s/he can call this fixed URL and shut down the REST server...
Well, we could update this to be 'behind' whatever authenticate you are providing. Do you think that would be a POST or a PUT?
The easiest way I can imagine: Remove the hardcoded shutdown URL and let the user shutdown the server from any endpoint by using a global variable or function.
So the default setting just needs to include a simple endpoint description and if somebody like me doesn't like this, one can write it's own endpoint including any form of authentication and if needed running subscripts to shutdown other things first.
How about this?
Sounds reasonable. Want to do a PR? Or want me to make the changes?
If you want me to do it, I should have this in a day or two.
Yeah, go ahead and give it a shot!
It was only a very small change. So it is done. See my pull request.
New version deployed!
https://www.powershellgallery.com/packages/RestPS/7.0.56