Allow GET method on /auth with BasicAuth

[zeehio]

Proposed change

nginx has a convenient feature named Authentication Based on Subrequest Result which allows to grant/deny access using basic authentication based on the result of a subrequest. That nginx module however only works with GET requests.

This Pull Requests allows users to provide auth credentials using Basic Auth in a GET request. This is convenient because it is then possible to use nginx to authenticate a third party app. Within the nginx server directive an add-on developer could use something like:

location = /.ha-auth {
    internal;
    proxy_pass              http://supervisor/auth;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
    proxy_set_header        X-Supervisor-Token "${SUPERVISOR_TOKEN}"; # The ${SUPERVISOR_TOKEN} needs to be set
}

location / {
    auth_request     /.ha-auth;
    auth_request_set $auth_status $upstream_status;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;
    #proxy_set_header X-Remote-User $remote_user;
    #proxy_set_header   X-Forwarded-User $http_authorization;
    proxy_pass http://127.0.0.1:5000/;  # your addon could use the X-Remote-User header with the username
}

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New feature (which adds functionality to the supervisor)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue:
• Link to documentation pull request: Document supervisor /auth GET method developers.home-assistant#767

Checklist

• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• The code has been formatted using Black (black --fast supervisor tests)
• Tests have been added to verify that the new code works.

If API endpoints of add-on configuration are added/changed:

• Documentation added/updated for developers.home-assistant.io

[zeehio]

Tested. Ready for review

[pvizeli]

Of curse, that is correct, but do we need to guide people there? We can still just accept GET without future validation if GET or POST.

[zeehio]

I removed those checks. It becomes a one line pull request :-)

[frenck]

Really nice addition! Thanks, @zeehio 👍