Skip to content

evanbaldonado/github-pages-jekyll-password-protection

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

GitHub Pages/Jekyll Password Protection

Automatically password protect (with encryption) certain pages on GitHub Pages/Jekyll sites using PageCrypt.

Demo

This repository serves as an example repository for password protecting pages. See example.html (password: examplepassword) and example-2.html (password: repo_by_evanbaldonado.com!).

Usage

  1. Configure passwords for .html pages in _protected_pages.txt.
    • Add one file per line (space-delimited in the format filename.html password).
    • Note that GitHub converts markdown (.md) files to .html files.
    • Because this file begins with an underscore, it will not be published when your site is deployed.
  2. Add a GitHub action/workflow for encrypting pages: /.github/workflows/pages-with-encryption.yml.
    • Make sure that it targets the correct branch you want to use for deployment (see line 6: branches: ["main"]).
  3. Automatically deploy this repository with GitHub Pages using GitHub Actions: Settings > Code and automation > Pages > Build and deployment > Source > Github Actions. You can manually run this Action; it will also automatically run when you update your repository.

Security

  • Static websites deployed with GitHub pages can't run server-side code, which means that traditional authentication approaches to access protected files aren't possible. Additionally, GitHub pages does not support .htaccess files, another easy way to password-protect pages.
  • This method relies on PageCrypt to encrypt pages using the Web Crypto API. This allows the user to view/access/download pages but only see their contents with a password.
    • Because the user can access these files, they can download them and perform a brute-force attack to attempt to unencrypt them. Your files are only as secure as the Web Crypto API, PageCrypt, and your passwords.
    • PageCrypt only encrypts .html files. For other assets (ex: .css files, .js files, and images), consider inlining them if they must remain private. See PageCrypt's documentation.
  • Note: although the password file (_protected_pages.txt) is not published along with your site, anyone with access to the repository itself can view it.
  • For more information, see PageCrypt's documentation.

License & credits

This repository by Evan Baldonado is published under the AGPL-3.0 license. It utilizes PageCrypt by Samuel Plumppu (a complete rewrite of Maximillian Laumeister's original code).

Contributing

Feel free to submit issues/pull requests!

Contact

You can start a discussion on this repository or contact password@evanbaldonado.com with questions. The PageCrypt repository also has additional information about the encryption process itself.