Add Basic Auth Support #1089

JustinMissmahl · 2025-01-17T04:03:37Z

Adds username/password authentication mode for self-hosted instances that want to manage users manually without OAuth providers.

Changes:

Backend:

basic_auth.py: Login endpoint and metadata endpoint returning {"google": null}
state.py: Added controlled_access_mode flag
main.py: CLI flag and env var handling
configure.py: Router mounting and auth middleware

Frontend (loginPrompt.tsx):

Basic auth detection from metadata response
Username/password form with loading/error states
Works in both mobile/desktop views
Preserves existing OAuth/email flows

Usage:

Enable controlled access mode via:
- CLI: --controlled-access
- ENV: KHOJ_CONTROLLED_ACCESS=true
Initial admin credentials:
- Username: [email protected]
- Password: admin
Managing Users:
- Login as admin at http://localhost:42110/server/admin
- Use Django admin interface to:
  - Create new users
  - Set passwords * Manage permissions
- Users can then login with their credentials at http://localhost:42110

Security Notes:

Default admin should be changed after first login
Each user needs to be manually created by admin
No self-registration - controlled environment

Testing:

docker compose up  # Uses KHOJ_CONTROLLED_ACCESS=true

Visit http://localhost:42110 - should show username/password form
Login with admin credentials
Create test user in admin panel
Test login with new user

Adds username/password authentication mode for self-hosted instances that want to manage users manually without OAuth providers. Changes: Backend: - basic_auth.py: Login endpoint and metadata endpoint returning {"google": null} - state.py: Added controlled_access_mode flag - main.py: CLI flag and env var handling - configure.py: Router mounting and auth middleware Frontend (loginPrompt.tsx): - Basic auth detection from metadata response - Username/password form with loading/error states - Works in both mobile/desktop views - Preserves existing OAuth/email flows Usage: 1. Enable controlled access mode via: - CLI: --controlled-access - ENV: KHOJ_CONTROLLED_ACCESS=true 2. Initial admin credentials: - Username: [email protected] - Password: admin 3. Managing Users: - Login as admin at http://localhost:42110/server/admin - Use Django admin interface to: * Create new users * Set passwords * Manage permissions - Users can then login with their credentials at http://localhost:42110 Security Notes: - Default admin should be changed after first login - Each user needs to be manually created by admin - No self-registration - controlled environment Testing: ```bash docker compose up # Uses KHOJ_CONTROLLED_ACCESS=true ``` 1. Visit http://localhost:42110 - should show username/password form 2. Login with admin credentials 3. Create test user in admin panel 4. Test login with new user

debanjum

Thanks for creating a PR to add basic auth support! I've left some comments to simplify the code. Let me know if you have any questions?

debanjum · 2025-01-21T06:12:23Z

docker-compose.yml

-    # build:
-      # context: .
+    build:
+      context: .
+      dockerfile: Dockerfile


Given context: . defaults to dockerfile: Dockerfile, the new dockerfile: Dockerfile line shouldn't be necessary

debanjum · 2025-01-21T06:13:05Z

docker-compose.yml

+    build:
+      context: .
+      dockerfile: Dockerfile


This should be commented out by default and the image: config above should be uncommented, so folks can use the pre-built image (instead of having to build the docker image locally)

debanjum · 2025-01-21T06:15:48Z

docker-compose.yml

-    command: --host="0.0.0.0" --port=42110 -vv --anonymous-mode --non-interactive
+    entrypoint: python3 src/khoj/main.py --host=0.0.0.0 --port=42110 -vv --controlled-access --non-interactive
+    # entrypoint: python3 src/khoj/main.py --host=0.0.0.0 --port=42110 -vv --anonymous-mode --non-interactive
+    # entrypoint: python3 src/khoj/main.py --host=0.0.0.0 --port=42110 -vv --non-interactive


Enabling basic auth via environment variable maybe better. That is by adding - ENABLE_CONTROLLED_ACCESS=True in the environment section for the Khoj service above

debanjum · 2025-01-21T06:16:59Z

docker-compose.yml

@@ -92,7 +97,9 @@ services:
      # Read more at https://docs.khoj.dev/miscellaneous/telemetry
      # - KHOJ_TELEMETRY_DISABLE=True
    # Comment out this line when you're using the official ghcr.io/khoj-ai/khoj-cloud:latest prod image.
-    command: --host="0.0.0.0" --port=42110 -vv --anonymous-mode --non-interactive
+    entrypoint: python3 src/khoj/main.py --host=0.0.0.0 --port=42110 -vv --controlled-access --non-interactive


We can revert this be a command as the Dockerfile sets the ENTRYPOINT to python3 src/khoj/main.py already

debanjum · 2025-01-21T06:17:44Z

docker-compose.yml

@@ -92,7 +97,9 @@ services:
      # Read more at https://docs.khoj.dev/miscellaneous/telemetry
      # - KHOJ_TELEMETRY_DISABLE=True
    # Comment out this line when you're using the official ghcr.io/khoj-ai/khoj-cloud:latest prod image.
-    command: --host="0.0.0.0" --port=42110 -vv --anonymous-mode --non-interactive
+    entrypoint: python3 src/khoj/main.py --host=0.0.0.0 --port=42110 -vv --controlled-access --non-interactive


We should default to anonymous mode for self-hosting users in my opinion. Multi-user setups for self-hosting users is not expected to be default

debanjum · 2025-01-21T06:42:31Z

src/khoj/configure.py

    if not state.anonymous_mode:
-        from khoj.routers.auth import auth_router
+        if state.controlled_access_mode:


Same ordering of conditionals comment as above. Let's check for OAuth first (i.e if not state.controlled_access_mode <add_oauth_router> else: <add_basic_auth_router>)

debanjum · 2025-01-21T06:43:47Z

src/khoj/configure.py

        client_id = request.query_params.get("client_id")
        if client_id:
-            # Get the client secret, which is passed in the Authorization header


Should we keep this and the comment below?

debanjum · 2025-03-18T15:46:31Z

src/interface/web/yarn.lock

@@ -4,38 +4,38 @@

 "@alloc/quick-lru@^5.2.0":
  version "5.2.0"
-  resolved "https://registry.yarnpkg.com/@alloc/quick-lru/-/quick-lru-5.2.0.tgz#7bf68b20c0a350f936915fcae06f58e32007ce30"
+  resolved "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz"


This should be reverted to use yarn instead of npm, e.g yarn install

debanjum · 2025-03-18T15:48:46Z

Dockerfile

+    django==5.0.10 \
+    fastapi==0.115.6 \
+    uvicorn==0.30.6 \
+    pydantic==2.10.5 \
+    starlette==0.41.3


Unclear why django and other package dependencies are being installed here instead of in pyproject.toml which also installs these dependencies

debanjum · 2025-05-12T16:37:28Z

Dockerfile

We should revert changes to this file, they seem tangential to this PR

debanjum requested changes May 12, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Basic Auth Support #1089

Add Basic Auth Support #1089

JustinMissmahl commented Jan 17, 2025

debanjum left a comment •

edited

Loading

debanjum Jan 21, 2025

debanjum Jan 21, 2025

debanjum Jan 21, 2025

debanjum Jan 21, 2025

debanjum Jan 21, 2025

debanjum Jan 21, 2025

debanjum Jan 21, 2025

debanjum Mar 18, 2025

debanjum Mar 18, 2025

debanjum May 12, 2025

Add Basic Auth Support #1089

Are you sure you want to change the base?

Add Basic Auth Support #1089

Conversation

JustinMissmahl commented Jan 17, 2025

debanjum left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

debanjum left a comment •

edited

Loading