8 ms·

Access Control for GitHub Pages

184 points by jbredeche 6y ago

bewuethr 6y ago
To clarify, this only applies to GitHub Enterprise – great for intranet sites. If you are on GitHub Enterprise.
- petepete 6y ago
  Ah damn, got excited by the headline for a moment there. Thought we'd have another excuse to switch away from Confluence.
- theptip 6y ago
  That's annoying. As far as I can tell this is a free feature in GitLab, and it's one of the ones I miss after moving back to Github. https://docs.gitlab.com/ee/user/project/pages/pages_access_control.html https://docs.gitlab.com/ee/user/project/pages/pages_access_c...
- beckingz 6y ago
  Look forward to the day when GitHub pages and sharepoint sites can be one and the same.
  - prepend 6y ago
    One of my big fears is that Microsoft will merge this kind of stuff into SharePoint. SharePoint is probably the best example of ruining and making something that should be simple horrible, and complex, and stupid, and poorly functioning. All it needs to be is a wiki. Instead it requires layers of admin and stuff 5000 settings that don’t work. And it’s really expensive.
wjdp 6y ago
Been using the same feature on GitLab for quite a while for publishing code coverage reports.
abhinav22 6y ago
This is great news
prepend 6y ago
This is really great news and I’ve been waiting for a while. I use this extensively on gitlab and these little pages sites are easier to use than markdown. However one thing that’s cool about GitLab is that we host it internally so any “public” site is available to anyone on the intranet without needing to log in. So the project sites started getting read by lots of users who don’t have GitLab logins and would never commit to a repo. I wish there was a way to link my orgs logins with GitHub so non-GitHub licensed users could view the sites. I mean, I can do that but I have to then buy GitHub licenses and make them create GitHub accounts just to view project docs. That’s pretty expensive compared to just keeping projects on my internal GitLab.
- codazoda 6y ago
  This. When I read the title I was really excited. All of my GitHub users can already access private wikis. It's nice that I can now publish a site to those same users, but I'd like to write docs for the non-technical users at my company without making them public. It would be nice if I could restrict a site to people on my company VPN or, better yet, an IP range.
  - osgovernment 6y ago
    Setup a gateway to do this or host your own GitLab. GitHub Pages uses a shared IP. Blocking based on IP would require them to rework their infrastructure.
  - johannes1234321 6y ago
    VPN and IP won't help - the trend is too move out of VPN. A big threat is always internal and byod opens up the intranet to all risks from the outside. The solution needed is to allow oauth-style authentication of corporate users.
pwdisswordfish5 6y ago
> With an internal repository, everyone in your enterprise will be able to view the Page with the same credentials they use to login to github.com Public service announcement: "login" is a noun; as a verb, you should write "log in". (Consider "knockout" vs. "knock out".) Another thing to watch out for: writing "setup" instead of "set up".
- hanniabu 6y ago
  Wow, thank you for clarifying this. I was actually wondering about this yesterday and just figured they could be used interchangeably but I also knew that in certain cases writing it a certain way just made more sense but I never knew the noun/verb rule behind it. I feel stupid now lol.
- tshaddox 6y ago
  If you're fond of this rule and want to remember to follow it, just consider how you would write the past tense of the verb.
  - jhardy54 6y ago
    Nitpick: This works for "logged in", but not "set up".
    - asidiali 6y ago
      Is setting up?
      - jhardy54 6y ago
        They said "past tense" whereas "setting up" is the present participle tense.
    - chordalkeyboard 6y ago
      “Set us up the bomb”
  - 6y ago
sn1de 6y ago
Baffling that this wasn't a day one feature. Doubly baffling that it now launches on Enterprise only with no guidance on if or when it will be generally available. Never an explanation why this couldn't have been there all along. You have it with the repos already. It almost seems like you would have to go out of your way not to have this baked in from day one. I'm a long term fan, but c'mon github, you're better than this.
- jrockway 6y ago
  I'm not that baffled, I guess. I would assume Github pages work something like "compile to HTML, push to a CDN" whereas Github itself queries a bunch of data from a database, reads the Git repo itself, etc. -- it's not a static page that can be served from a CDN, the page is generated by an application. Therefore, in the repo case it is easy to check authorization among the other things the page generation code does, whereas for static pages, there is currently no application code that runs for every request, and so no place to put an authorization check. Obviously you could make the Github Page load a dynamic page that checks auth, but I guess they wanted scalability more than they wanted features, and that's what we arrived with. TL;DR: I'm not that baffled. If a feature isn't in the spec, you shouldn't expect an implementation that makes it easy to add that feature.
  - dtech 6y ago
    You can still put a static page behind authentication, it doesn't have to immediately be a dynamic page with database interaction.
    - teraflop 6y ago
      If you ask me, any page whose behavior depends on the currently logged-in user's identity, including the list of groups they're a member of, is not "static" in any meaningful sense.
      - cratermoon 6y ago
        You can put an image behind an login. The page or whatever content that's behind the auth wall doesn't even even have to be aware of that wall.
ngrilly 6y ago
Too bad it’s only for Enterprise and not Teams.
cratermoon 6y ago
Hasn't gitlab had this since they started?
arvindamirtaa 6y ago
This is wonderful news to host sensitive internal documentation without bending over backwards. Too bad it's only for enterprise accounts.
tumblewit 6y ago
I'm not sure if this feature exists on github or i couldn't find it but i would like to have my github pages repository private and the blog public which is possible with gitlab.
- josepmdc 6y ago
  You can do the same with GitHub. Until now GitHub pages are always public even if the repo is private.
  - tumblewit 6y ago
    i see thanks
foo123456789 6y ago
What I would like to have is to make the repo of my github page private, but have the page still be visible.

184 points by jbredeche 6y ago

bewuethr 6y ago

To clarify, this only applies to GitHub Enterprise – great for intranet sites. If you are on GitHub Enterprise.

petepete 6y ago
Ah damn, got excited by the headline for a moment there. Thought we'd have another excuse to switch away from Confluence.
theptip 6y ago
That's annoying. As far as I can tell this is a free feature in GitLab, and it's one of the ones I miss after moving back to Github. https://docs.gitlab.com/ee/user/project/pages/pages_access_control.html https://docs.gitlab.com/ee/user/project/pages/pages_access_c...
beckingz 6y ago
Look forward to the day when GitHub pages and sharepoint sites can be one and the same.
- prepend 6y ago
  One of my big fears is that Microsoft will merge this kind of stuff into SharePoint. SharePoint is probably the best example of ruining and making something that should be simple horrible, and complex, and stupid, and poorly functioning. All it needs to be is a wiki. Instead it requires layers of admin and stuff 5000 settings that don’t work. And it’s really expensive.

wjdp 6y ago

Been using the same feature on GitLab for quite a while for publishing code coverage reports.

abhinav22 6y ago

This is great news

prepend 6y ago

This is really great news and I’ve been waiting for a while. I use this extensively on gitlab and these little pages sites are easier to use than markdown. However one thing that’s cool about GitLab is that we host it internally so any “public” site is available to anyone on the intranet without needing to log in. So the project sites started getting read by lots of users who don’t have GitLab logins and would never commit to a repo. I wish there was a way to link my orgs logins with GitHub so non-GitHub licensed users could view the sites. I mean, I can do that but I have to then buy GitHub licenses and make them create GitHub accounts just to view project docs. That’s pretty expensive compared to just keeping projects on my internal GitLab.

codazoda 6y ago
This. When I read the title I was really excited. All of my GitHub users can already access private wikis. It's nice that I can now publish a site to those same users, but I'd like to write docs for the non-technical users at my company without making them public. It would be nice if I could restrict a site to people on my company VPN or, better yet, an IP range.
- osgovernment 6y ago
  Setup a gateway to do this or host your own GitLab. GitHub Pages uses a shared IP. Blocking based on IP would require them to rework their infrastructure.
- johannes1234321 6y ago
  VPN and IP won't help - the trend is too move out of VPN. A big threat is always internal and byod opens up the intranet to all risks from the outside. The solution needed is to allow oauth-style authentication of corporate users.

pwdisswordfish5 6y ago

> With an internal repository, everyone in your enterprise will be able to view the Page with the same credentials they use to login to github.com Public service announcement: "login" is a noun; as a verb, you should write "log in". (Consider "knockout" vs. "knock out".) Another thing to watch out for: writing "setup" instead of "set up".

hanniabu 6y ago
Wow, thank you for clarifying this. I was actually wondering about this yesterday and just figured they could be used interchangeably but I also knew that in certain cases writing it a certain way just made more sense but I never knew the noun/verb rule behind it. I feel stupid now lol.
tshaddox 6y ago
If you're fond of this rule and want to remember to follow it, just consider how you would write the past tense of the verb.
- jhardy54 6y ago
  Nitpick: This works for "logged in", but not "set up".
  - asidiali 6y ago
    Is setting up?
    - jhardy54 6y ago
      They said "past tense" whereas "setting up" is the present participle tense.
  - chordalkeyboard 6y ago
    “Set us up the bomb”
- 6y ago

sn1de 6y ago

Baffling that this wasn't a day one feature. Doubly baffling that it now launches on Enterprise only with no guidance on if or when it will be generally available. Never an explanation why this couldn't have been there all along. You have it with the repos already. It almost seems like you would have to go out of your way not to have this baked in from day one. I'm a long term fan, but c'mon github, you're better than this.

jrockway 6y ago
I'm not that baffled, I guess. I would assume Github pages work something like "compile to HTML, push to a CDN" whereas Github itself queries a bunch of data from a database, reads the Git repo itself, etc. -- it's not a static page that can be served from a CDN, the page is generated by an application. Therefore, in the repo case it is easy to check authorization among the other things the page generation code does, whereas for static pages, there is currently no application code that runs for every request, and so no place to put an authorization check. Obviously you could make the Github Page load a dynamic page that checks auth, but I guess they wanted scalability more than they wanted features, and that's what we arrived with. TL;DR: I'm not that baffled. If a feature isn't in the spec, you shouldn't expect an implementation that makes it easy to add that feature.
- dtech 6y ago
  You can still put a static page behind authentication, it doesn't have to immediately be a dynamic page with database interaction.
  - teraflop 6y ago
    If you ask me, any page whose behavior depends on the currently logged-in user's identity, including the list of groups they're a member of, is not "static" in any meaningful sense.
    - cratermoon 6y ago
      You can put an image behind an login. The page or whatever content that's behind the auth wall doesn't even even have to be aware of that wall.

ngrilly 6y ago

Too bad it’s only for Enterprise and not Teams.

cratermoon 6y ago

Hasn't gitlab had this since they started?

arvindamirtaa 6y ago

This is wonderful news to host sensitive internal documentation without bending over backwards. Too bad it's only for enterprise accounts.

tumblewit 6y ago

I'm not sure if this feature exists on github or i couldn't find it but i would like to have my github pages repository private and the blog public which is possible with gitlab.

josepmdc 6y ago
You can do the same with GitHub. Until now GitHub pages are always public even if the repo is private.
- tumblewit 6y ago
  i see thanks

foo123456789 6y ago

What I would like to have is to make the repo of my github page private, but have the page still be visible.