Web interface

​​
​​
OctoBot provides a web interface for the following purposes:
Checking OctoBot's status and moves
Interacting with OctoBot
Configure OctoBot
Configuration
web config
port is the port you want the web interface to be accessible from. Changing it allows you to have multiple OctoBots running on the same computer.
auto open in web browser is wether starting your OctoBot should open a new tab on your browser to display the web interface
requires password is wether the web interface of your OctoBot should be protected by a password
Protect your web interface
Using an authentication password
You can set a password to protect your web interface. This way you can secure the access to your OctoBot when hosting it on a cloud or just add a security layer to your setup.
By default no password is required.
You can activate the password authentication from the web interface configuration, it is also where you can set and change your password.
Any IP will be automatically blocked after 10 authentication failures in a row. IPs will remain blocked until your OctoBot restarts. If you accidentally block your IP, you can just restart your OctoBot.
How to set it up ?
Go to "Accounts" page
Select "Interfaces" on the left menu
Click on "********" next to "Password: "
Override the "****" with your password
Click on validate
Click on "SAVE AND RESTART" red button on the left menu
You forgot your password
If you forgot your password, go to your user/config.json file and change:
"require-password": true,
into:
"require-password": false,
Then restart your OctoBot. This way you will be able to access your OctoBot without a password and then change it.
About the web interface authentication
OctoBot's web interface authentication works on the assumption that you are the only person being able to access your OctoBot's file system and the associated processes. This authentication can be deactivated by anyone being able to edit your user/config.json and restart your OctoBot process.
Only a SHA256 hash of your password will be stored in you user/config.json file. This is making it impossible to go back to the original password you entered.
Blocking requests from other websites (CSRF)
You can set the CORS_ALLOWED_ORIGINS environment variable before starting your OctoBot, this way only requests from the specified origin(s) will be answered to.
Examples:
CORS_ALLOWED_ORIGINS=https://mybot.com
CORS_ALLOWED_ORIGINS=http://localhost:5001
CORS_ALLOWED_ORIGINS=https://mybot.com,https://myotherwebsite.com
Requests from other origins will be refused with a 400 error and the web interface will behave as if OctoBot was constantly disconnected.
By default, no request filter is set (equivalent to CORS_ALLOWED_ORIGINS=*) which might make your bot vulnerable to Cross Site Request Forgery attacks.
user/confg.json configuration
Add in user/config.json in the services key :
"web": {
 "auto-open-in-web-browser": false,
 "ip": "0.0.0.0",
 "password": "",
 "port": 5001,
 "require-password": false
}
You can also change the IP your web interface is binding to from user/config.json.
Example:
"services": {
 "a service": {
​
 },
 "web": {
 "auto-open-in-web-browser": false,
 "ip": "0.0.0.0",
 "password": "",
 "port": 5001,
 "require-password": false
 },
 "another service": {
​
 }
}

Last modified 1mo ago