Description
Currently, when a user enables authentication in settings, unauthenticated users are presented with a form to log in with. This is useful to prevent leaking sensitive information when using more private widgets on the dashboard.
However, when using non-interactive methods of displaying the dashboard, e.g. Wallpaper Engine, it's not possible to fill in this form to properly authenticate.
As a solution, I'd suggest allowing credentials to be provided via HTTP basic authentication. This would allow optionally providing the credentials directly in the URL, meaning that it can be used in these non-interactive contexts.
I can't see any particular additional security implications from this, but it might make sense to have this as an optional key under the existing authentication config so that it's only enabled for those who may need it.
Description
Currently, when a user enables authentication in settings, unauthenticated users are presented with a form to log in with. This is useful to prevent leaking sensitive information when using more private widgets on the dashboard.
However, when using non-interactive methods of displaying the dashboard, e.g. Wallpaper Engine, it's not possible to fill in this form to properly authenticate.
As a solution, I'd suggest allowing credentials to be provided via HTTP basic authentication. This would allow optionally providing the credentials directly in the URL, meaning that it can be used in these non-interactive contexts.
I can't see any particular additional security implications from this, but it might make sense to have this as an optional key under the existing authentication config so that it's only enabled for those who may need it.