1 . Does rosbridge come with user authentication and role-dependent access levels?
No. rosbridge_suite only deals with providing the infrastructure to bridge into a ROS nodegraph, nothing more. It is not a web application itself nor is it exclusively used for that.
2 . Can I limit what rosbridge exposes or is every ROS topic and service available for any (malicious) user?
re: limit: yes, in a way: see the rosapi/readme. rosapi (the component responsible for interfacing with the ROS nodegraph) uses an 'opt-in' list of resources to expose.
This is not linked to any user auth afaik though.
3 . ros_auth seems to address some of this, but will it do the job?
I've not used this myself, but it would seem rosauth provides a way to do authentication for rosbridge_suite. I could not find any documentation on the wiki, but this comment on the issue tracker is rather descriptive:
[..] rosbridge will wait for an auth op code to come in. If this is not the first message to come in, or if an invalid token is given, the connection is dropped.
It does seem to have the concept of user levels, which does not necessarily translate to role, but is a start.
The UI side of all this is out-of-scope of rosbridge_suite though, so that will probably have to be developed. The various rosjs and related libraries can probably help there.
Originally posted by gvdhoorn with karma: 86574 on 2018-01-25
This answer was ACCEPTED on the original site
Post score: 6
Original comments
Comment by gvdhoorn on 2018-01-25:
Note that there is no security in ROS 1, it was never a design requirement. To quote Brian at the ROS-I conference in Stuttgart:
If you tell me you've found a security issue in ROS 1, you're lying: there is no security.
As rosbridge_suite is transparent, it'll have to be made secure.
Comment by gvdhoorn on 2018-01-25:
Some experimental work to remedy this situation can be found in sros.
ROS 2 takes this much further, with full support for (DDS based) security infrastructure such as roles, certificates, authentication and authorisation, access policies etc.
Comment by gvdhoorn on 2018-01-25:
You might also be interested in the ROSCon17 presentation Reactive web interfaces with Polymer and ROS (slides, video).
Comment by knxa on 2018-01-31:
Thanks for your thorough reply (as always, where would this forum be without you). I will need to dig more into this.
