mTLS / HTTP headers

[dynek]

Hello and thanks for working on this tool,

I haven't tested it yet but I've been looking for a solution to synchronize files across some devices, but I'm looking for mTLS between the client and the server or customizable HTTP headers that could be specified (e.g. to bypass Cloudflare Access).

Can you let us know if you plan to allow such things in the future ?

Many thanks

[dynek]

No comment? Shall this be closed?

Thank you

[johaven]

Hi @dynek,

Synchronization already works well across multiple devices, with built-in authentication mechanisms between clients and the server, as well as the ability to revoke access when needed.

At the moment, support for mTLS or custom HTTP headers is not a common request from the community, so it is not currently prioritized or planned on our roadmap.

If the goal is to identify Sync-in clients in order to bypass Cloudflare Access, the User-Agent header can be used to identify them.

[dynek]

I'm trying to find a solution that allows me to synchronize file securely without a VPN being active.
Today I'm using either Cloudflare Access headers or mTLS, that's what I'm looking for.

Thank you for your answer

[johaven]

Yes, this should be achievable with Nginx. Nginx can handle mutual TLS (mTLS) by validating client certificates at the TLS layer, without requiring a VPN.

If you configure a trusted client CA and enable client certificate verification, Nginx will only allow connections from authenticated clients.

server {
    listen 443 ssl;
    server_name sync.example.com;

    # Server TLS certificate
    ssl_certificate     /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;

    # CA that signs client certificates
    ssl_client_certificate /etc/nginx/certs/client-ca.crt;

    # Require and verify client certificates
    ssl_verify_client on;
    ssl_verify_depth 2;

    location / {
        proxy_pass http://sync-in:8080;

        # Optional: forward client cert information to the backend
        proxy_set_header X-Client-Verify $ssl_client_verify;
        proxy_set_header X-Client-DN     $ssl_client_s_dn;
        proxy_set_header X-Client-Cert   $ssl_client_escaped_cert;
    }
}

[dynek]

Server-side yes, but then the client must support mTLS as well, that's my original question.

[johaven]

For the sync API, this shouldn’t be an issue since Electron/Node can use mTLS by explicitly configuring the client certificate, key, and CA paths, but for the WebView/BrowserWindow the client certificate must be provisioned in the system certificate store (Windows Certificate Store, macOS Keychain, etc.), as Electron/Chromium cannot load a client certificate directly from app configuration.
We currently have many other priorities, but we’ll keep this issue open as a possible enhancement.