<p>I have been importing data just fine using Feed Me <code>Feed URL</code>s that point to .json files placed above web root. (It's a great plugin.)</p>
<p>But for some kinds of import I now want a Feed URL to be an <code>https</code> addressable URL that is nonetheless not publicly viewable to anyone who knows the URL.</p>
<p>So I thought I'd be able to do the following:</p>
<ol>
<li>Allow my client to compile JSON formatted data via a tool I've made</li>
<li>Paste that data into a Globals field that generates a template generated URL with a JSON mime type</li>
<li>Have that template only render its content if the viewer is logged in</li>
<li>Point Feed Me at that URL, on the assumption that it too is 'logged in' to its own CMS</li>
</ol>
<p>But it turns out that Feed Me doesn't play with step 3, even though it's a relative URL specified as:</p>
<pre><code>@web/path/to/json
</code></pre>
<p>I guess I can have the template be sensitive to an obscure URL parameter instead of logged in state.</p>
<p>Any other ideas?</p>
<hr />
<h2>Update 1</h2>
<p>FWIW the param approach works fine, so that:</p>
<pre><code>@web/path/to/json
</code></pre>
<p>…renders nothing but…</p>
<pre><code>@web/path/to/json?myWeirdParamName=obscureValue
</code></pre>
<p>…renders the data.</p>
<p>So I point Feed Me at the latter.</p>
<hr />
<h2>Update 2</h2>
<p>I just found the docs section on configuring <a href="https://docs.craftcms.com/feed-me/v4/get-started/configuration.html#example-requestoptions" rel="nofollow noreferrer">requestOptions</a>, which suggests to me that there is a way to have Feed Me be governed by authentication, but I'm too dumb to make sense of what it might be trying to tell me.</p>
<p>Can someone help me join the dots?</p>

CC BY-SA 4.0
2021-03-25T22:59:29.803Z
`requestOptions` is passed directly onto Guzzle, which will use HTTP basic auth headers. So you should be able to secure the feed with HTTP basic auth via .htaccess/nginx confi/etc.
Brad Bell
CC BY-SA 4.0
2021-03-25T22:59:44.650Z
Caveat: I've never tried it myself.
Brad Bell
<plugin-feedme><security>
Securing Feed Me URLs
# Securing Feed Me URLs

(Asked by: username_0 on 2021-03-25)

I have been importing data just fine using Feed Me Feed URLs that point to .json files placed above web root. (It's a great plugin.)
But for some kinds of import I now want a Feed URL to be an https addressable URL that is nonetheless not publicly viewable to anyone who knows the URL.
So I thought I'd be able to do the following:

Allow my client to compile JSON formatted data via a tool I've made
Paste that data into a Globals field that generates a template generated URL with a JSON mime type
Have that template only render its content if the viewer is logged in
Point Feed Me at that URL, on the assumption that it too is 'logged in' to its own CMS

But it turns out that Feed Me doesn't play with step 3, even though it's a relative URL specified as:
@web/path/to/json

I guess I can have the template be sensitive to an obscure URL parameter instead of logged in state.
Any other ideas?

Update 1
FWIW the param approach works fine, so that:
@web/path/to/json

…renders nothing but…
@web/path/to/json?myWeirdParamName=obscureValue

…renders the data.
So I point Feed Me at the latter.

Update 2
I just found the docs section on configuring requestOptions, which suggests to me that there is a way to have Feed Me be governed by authentication, but I'm too dumb to make sense of what it might be trying to tell me.
Can someone help me join the dots?

**Tags:** plugin-feedme, security

> **Comments:**
> **username_1**: `requestOptions` is passed directly onto Guzzle, which will use HTTP basic auth headers. So you should be able to secure the feed with HTTP basic auth via .htaccess/nginx confi/etc.  
> **username_1**: Caveat: I've never tried it myself.  

---

## 0 answers

