Can UI3 be served by an open-source webserver like nginx, httpd, etc?

[ryangriggs]

Or does it require the built-in server in Blue Iris?

[bp2008]

Technically it can be served by any other web server, but it is not functional straight out of the box. Here it is on github pages for example:
https://bp2008.github.io/ui3/ui3.htm

There are a number of challenges to making it functional:

• UI3 won't know what is the address of your Blue Iris server, and although it is relatively simple to add javascript that maeks UI3 connect to a different backend Blue Iris server, no GUI has been built for you to configure that.
• Sites hosted via HTTPS can only send requests to other HTTPS sites (Blue Iris's web server does not support HTTPS natively).
• Some features such as event-triggered sounds work by getting a list of available sound files from Blue Iris's API, then loading those sound files with HTTP(S). Blue Iris would be unable to enumerate the sound files available on a different web server, only the ones hosted by Blue Iris itself.

[ryangriggs]

Thanks @bp2008, my main goal is to expose UI3 to the internet via a well-known, tested web server, seeking to avoid any unknown vulnerabilities in the built-in BI web server which may allow attackers to gain access to the BI host PC. My main concern is that the built-in BI server, according to Ken, is custom software (written by him), and not based on any open source or commercial product. Thus it has not been evaluated for vulnerabilities to the extent that public, well-known web servers have. I wanted to offer my customers additional assurance that the public-facing webserver was a well-known, thoroughly tested public app (such as httpd, nginx, IIS, etc) which has been reviewed for such vulnerabilities.

Note that I am NOT asking how to prevent unauthorized access to the UI3 interface. While access control is important, it is not the concern I'm seeking to address here. The concern is exploitation of vulnerabilities in the built-in http server, allowing an attacker to gain control of the BI host computer (remote code execution, crashing the system, etc). Since it is closed-source, we can't evaluate it for such vulnerabilities, and since the user-base of BI is much smaller than that of, say nginx, it has not been tested to the same extent.

So you're saying UI3 can be served via a third-party web server? For example, how would I go about serving UI3 with nginx? I know how to serve the www directory, but I don't know how to point nginx (or any server) to the Blue Iris video streams and ensure all stream types are available. If it's a simple pass-through/proxy of HTTP requests to the built-in BI http server, then it doesn't solve the problem because the BI http server will still see the incoming requests, potentially exposing its vulnerabilities. However, if there are read-only video streams that nginx can serve directly, I think that would bypass any involvement of the built-in http server and thus mitigate most (all?) such attack vectors...

Your thoughts on this? Thanks for your time.

[bp2008]

There is a lot of communication with Blue Iris via JSON messages. And a proprietary video streaming protocol which is really just an HTTP request with a streaming response. And a number of other HTTP requests (getting thumbnails of clips, jpeg snapshots, etc.)

There is a lot of stuff there to sanitize if your goal is making sure no malformed requests can reach Blue Iris's built in web server. I do understand your concerns but there is just no easy way to fully resolve them while still providing access via the open internet. I'd trust an nginx proxy in front of Blue Iris more than not having it though.

[bp2008]

If all you're wanting is to use an HTTPS reverse proxy, then that is much better supported. Many people including myself use it that way. https://github.com/bp2008/ui3/wiki/Using-UI3-with-a-reverse-proxy-server