How to allow requests to custom html page?

[jwgn]

Requests to the *root* or /index.html return a customizable HTML page

How do we do this? I have set <HomePagePath>/opt/deceptifeed/www/</HomePagePath> in the HTTP honeypot section, but requests to port 8080 asks for authorization and then returns a 401 instead of delivering the index.html file.

[jwgn]

Seems the correct directive is <homePagePath> with a non-capital h

But now everything except index.html delivers a 404 instead of basic auth.

[r-smith]

I just realized I don't have any documentation published for the configuration options. I'll try to get that up soon.

homePagePath only allows a single file at this time. So you have to point to a single .html file, not a folder.

Support for specifying a folder is planned and should be out in a week or 2. I'll be using Go's brand new os.Root traversal-resistant virtual filesystem.

The HTTP honeypot settings are (case-sensitive):
<homePagePath>your_path_goes_here</homePagePath>
<errorPagePath>your_path_goes_here</errorPagePath>

homePagePath - Path to a single file to serve as the root and index.html. Soon this will allow for folders as well.
errorPagePath - Path to an optional file to serve as an error/404 page. If not specified, the server returns a simple error response.

[jwgn]

Thanks!

I think it would be great to deliver only allowed paths and request basic auth for all other paths. Every interaction with basic auth should then be logged.

[r-smith]

Support for serving a directory is now available in version 0.63.0. Set <homePagePath> to a directory and it'll serve files from there. If you have an index.html file in the directory, it'll serve that by default.

When an invalid path is requested, the server always returns a 404 response code. I'm looking at making the error response configurable. Right now, the basic auth prompt you were seeing only shows when you don't set a custom homePagePath. It's the built-in/default page.

[r-smith]

The original request for serving custom HTML files was implemented long ago. But there was also mention of prompting for basic auth when clients request a non-existant path. Previously, that wasn't possible. But now it is!

There's a new errorCode option in the HTTP honeypot config. When set to 401, the honeypot injects the headers needed to prompt for basic auth. So now your requests to index.html will serve you custom file, and requests to anything else prompts for credentials.

Example snippet in the config:

<server type="http">
  <enabled>true</enabled>
  <errorCode>401</errorCode>
  <homePagePath>/var/www/mysite</homePagePath>
</server>

The features were recently added and will be included in the next release.