The "localauth" setting:
If enabled, require that HTTP connections from the loopback
address (127.0.0.1) be authenticated by password. If false,
some HTTP requests might be granted full "Setup" user
privileges without having to present login credentials.
This mechanism allows the "fossil ui" command to provide
full access to the repository without requiring the user to
log in first.
In order for full "Setup" privilege to be granted without a login, the following conditions must be met:
- (1)
- This setting ("localauth") must be off
- (2)
- The HTTP request arrive over the loopback TCP/IP address (127.0.01) or else via SSH.
- (3)
- The request must be HTTP, not HTTPS. (This restriction is designed to help prevent accidentally providing "Setup" privileges to requests arriving over a reverse proxy.)
- (4)
- The command that launched the fossil server must be one of the following: (a) "fossil ui" (b) "fossil server" with the --localauth option (c) "fossil http" with the --localauth option (d) CGI with the "localauth" setting in the cgi script.
For maximum security, set "localauth" to 1. However, because of the other restrictions (2) through (4), it should be safe to leave "localauth" set to 0 in most installations, and especially on cloned repositories on workstations. Leaving "localauth" at 0 makes the "fossil ui" command more convenient to use.