Security

CL-HTTP allows you to restrict access to URLs in one of two ways:

  • Subnet security
  • User authentication

These are explained in greated detail in the following sections.

Subnet security

By specifying a secure subnet you restrict access to a particular URL to a specified list of IP addresses, where 0 can be used as a wildcard. For example,

(export-url "/hosts.html")
            :computed
            :response-function 'hosts-page
            :secure-subnets '("80.288.178.48" "212.87.90.42"))

restricts access to the two specified IP addresses.

123.123.123.0 matches all the IP addresses in the subnet.

The following export arguments allow control over which clients can perform HTTP methods such as GET, HEAD, POST, :OPTIONS, or :TRACE (read access) versus PUT or DELETE (write access).

  • :READ-SUBNETS allows read access to be specified at the level of URLs as they are exported.
  • :WRITE-SUBNETS allows write access to be specified at the level of URLs as they are exported.

DEFINE-READ-SUBNETS restricts read access globally to the server. DEFINE-WRITE-SUBNETS restricts write access globally to the server.

Write access presumes read access, and consequently, IP addresses from the write subnets need not be included in the read subnets. To select the global authentication policy for write methods,

HTTP:*ACCEPT-WRITE-METHODS*.

DEFINE-SUBNET can be used to specify named subnet for use in subnet specifications. Note that named subnets are resolved when they are used, for example by a call to EXPORT-URL, and therefore, changes to named subnets require re-export of URL referring to them.

User Authentication

URL authentication can be specified using the :authentication-realm and :capabilities export arguments.

For example, to create a single basic realm called :admin:

(add-realm :identifont-admin :basic)

We can define users in the realm as follows:

(add-user "david" :admin
          :password "secret123"
          :personal-name "David Johnson-Davies"
          :email-address "david@interface.co.uk")

We can then export a URL with access restricted to that realm as follows:

(export-url #u("/admin.html" :host #.*interface*)
            :html-computed-form
            :form-function #'admin-form
            :response-function #'respond-to-admin-form
            :authentication-realm :admin
            :capabilities nil)

The default setting of :capabilities nil allows access to anyone in the realm. Alternatively, access control groups can be created within the realm, and URLs restricted to users with specified capabilities.


blog comments powered by Disqus