Secret creation non public?

[apiening]

Is it possible to somehow restrict the creation of secrets for example by basic authentication?
The secret links should still function directly without authentication.

I'm a little bit sceptic on providing the full functionality (including creation of new secrets) as a free unlimited public service. Since I can't control what people share with it, there might be legal issues that I would prefer to avoid.

[kleinron]

IMO you'd still have the same legal issues even when authentication is applied. I don't see how authentication is related to the subject.

[neuhaus]

With authentication you can limit creation of new secrets to those who are authorized (duh!)

[kleinron]

ok, now I see your point.
however, this adds friction to the entire process. not so nice..

[simonerota]

On our case we solved this with a reverse proxy (I think that's reccommended in any case) enforcing authentication for the base path '/' while allowing unauthenticated access to /snappass.* (secret reveal) and /static/* (resources such as js, css) paths.

[neuhaus]

That sounds like a good solution, perhaps a configuration like that could be added to the documentation.