some cleanup of mhttpd:
- remove obsolete c-generated equipment view page (replaced by eqtable.html)
- remove support for obsolete versions of mongoose (HAVE_MONGOOSE4, HAVE_MONGOOSE6, mhttpd6)
- remove support for https, openssl and mbedtls
support for https may return after we upgrade to a current version of mongoose (latest is 7.23, we have 6.16).
support for user passwords in mhttpd I leave alone for now,
but their security is limited:
a) lacking https, passwords are transmitted in clear text, this is only safe
for localhost connections) and
b) mhttpd always used the unusual http digest authentication,
which is no longer recommended because of:
b1) weak/insecure server-side password storage and
b2) weak security of the digest authentication token itself
for secure use of MIDAS, we recommend placing it behind a password protected https proxy (i.e. apache httpd)
K.O. |