Authelia + Chrome extension

[ShlomiD83]

Hi,
I want to put my instance behind Authelia but still be able to use the Chrome extension, which endpoint I need to set to bypass?

[Bubka]

Hi,

all endpoints starting with /api/* , requested with header Authorization: Bearer [your_personal_token]

[ShlomiD83]

Bypass this /api/* in Authelia configuration?
What do you mean " requested with header Authorization: Bearer [your_personal_token]"?

[Bubka]

2FAuth (the web app) uses the same API as the browser extension. When the endpoints are requested by the extension there is an Authorization header with a bearer token in it. When the endpoints are requested by the web app, this header is not in the requests (the auth is done with another header & cookies). So by tracking this header you can identify requests made by a third party like the extension. I don't know how authelia works nor how to configure it, so maybe the header thing is useless. Just wanted to be thorough.

[ShlomiD83]

2FAuth (the web app) uses the same API as the browser extension. When the endpoints are requested by the extension there is an Authorization header with a bearer token in it. When the endpoints are requested by the web app, this header is not in the requests (the auth is done with another header & cookies). So by tracking this header you can identify requests made by a third party like the extension. I don't know how authelia works nor how to configure it, so maybe the header thing is useless. Just wanted to be thorough.

Thank you for thorough anawer.

[ShlomiD83]

bypassing ^/api.*$ apparently did the trick, Authelia still protects the web app but the chrome extension is bypassed.

[ShlomiD83]

bypassing ^/api.*$ apparently did the trick, Authelia still protects the web app but the chrome extension is bypassed.

This also allows the Android app of 2FAuth to connect successfully.

[IceBag77]

That's it