Re: [libtorrent] tracker URL authentication

[arvid <ar...@cs...>]

On 2014-12-30 09:49, Thomas Vincent-Sweet wrote:
> Hello,
> 
> Firstly, thanks for that amazing tool that is libtorrent. :) One has to
> love OSS.
> 
> I am trying to integrate a torrenting feature in one of my projects, 
> and am
> using a private tracker which would need authentication of the peers
> connecting to it. There is a torrent_handle function: set_tracker_login
> which supposedly does what I want, but it doesn't seem to work when I 
> use
> it.
> 
> I have modified a PHP tracker (PHPBTTracker) to handle authentication, 
> but
> even when I set the tracker login on the torrent handle, the headers 
> are
> not filled with the Authorization: Basic <Base64 encoded> information.
> 
> Anyway, I would prefer to use URL authentication (having an HTTP URL
> containing  ?username=user&password=pass ) instead, and libtorrent 
> doesn't
> support that although I found a TODO in the code that would seem to
> indicate that the feature is/was thought of?
> 
> *http_tracker_connection.cpp:*
> 93: // TODO: 0 support authentication (i.e. user name and password) in 
> the
> URL

It does indeed look like this feature broke at some point, at some 
refactoring.

The reason for this is probably that nobody uses it, as far as I know.

What people normally do is to include an auth-token in the URL, and have 
the
PHP code verify the token.

Keep in mind that either solution requires HTTPS to not send the 
password in the clear.

> Is this type of authentication indeed a missing feature in libtorrent, 
> or
> am I missing something there?
> 
> I might have to rework my design to allow for a different way to
> authenticate with the tracker (based on IP address for instance) but I
> would prefer to avoid that if possible.

-- 
Arvid Norberg