Body: <p>I have been importing data just fine using Feed Me <code>Feed URL</code>s that point to .json files placed above web root. (It's a great plugin.)</p>
  <p>But for some kinds of import I now want a Feed URL to be an <code>https</code> addressable URL that is nonetheless not publicly viewable to anyone who knows the URL.</p>
  <p>So I thought I'd be able to do the following:</p>
  <ol>
  <li>Allow my client to compile JSON formatted data via a tool I've made</li>
  <li>Paste that data into a Globals field that generates a template generated URL with a JSON mime type</li>
  <li>Have that template only render its content if the viewer is logged in</li>
  <li>Point Feed Me at that URL, on the assumption that it too is 'logged in' to its own CMS</li>
  </ol>
  <p>But it turns out that Feed Me doesn't play with step 3, even though it's a relative URL specified as:</p>
  <pre><code>@web/path/to/json
  </code></pre>
  <p>I guess I can have the template be sensitive to an obscure URL parameter instead of logged in state.</p>
  <p>Any other ideas?</p>
  <hr />
  <h2>Update 1</h2>
  <p>FWIW the param approach works fine, so that:</p>
  <pre><code>@web/path/to/json
  </code></pre>
  <p>…renders nothing but…</p>
  <pre><code>@web/path/to/json?myWeirdParamName=obscureValue
  </code></pre>
  <p>…renders the data.</p>
  <p>So I point Feed Me at the latter.</p>
  <hr />
  <h2>Update 2</h2>
  <p>I just found the docs section on configuring <a href="https://docs.craftcms.com/feed-me/v4/get-started/configuration.html#example-requestoptions" rel="nofollow noreferrer">requestOptions</a>, which suggests to me that there is a way to have Feed Me be governed by authentication, but I'm too dumb to make sense of what it might be trying to tell me.</p>
  <p>Can someone help me join the dots?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-03-25T22:59:29.803Z
Comments.Text: `requestOptions` is passed directly onto Guzzle, which will use HTTP basic auth headers. So you should be able to secure the feed with HTTP basic auth via .htaccess/nginx confi/etc.
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-03-25T22:59:44.650Z
Comments.Text: Caveat: I've never tried it myself.
Comments.UserDisplayName: Brad Bell
Tags: <plugin-feedme><security>
Title: Securing Feed Me URLs
ThreadText: # Securing Feed Me URLs
  
  (Asked by: username_0 on 2021-03-25)
  
  I have been importing data just fine using Feed Me `Feed URL`s that point to .json files placed above web root. (It's a great plugin.)
  
  But for some kinds of import I now want a Feed URL to be an `https` addressable URL that is nonetheless not publicly viewable to anyone who knows the URL.
  
  So I thought I'd be able to do the following:
  
  1. Allow my client to compile JSON formatted data via a tool I've made
  2. Paste that data into a Globals field that generates a template generated URL with a JSON mime type
  3. Have that template only render its content if the viewer is logged in
  4. Point Feed Me at that URL, on the assumption that it too is 'logged in' to its own CMS
  
  But it turns out that Feed Me doesn't play with step 3, even though it's a relative URL specified as:
  
  ```
  @web/path/to/json
  
  ```
  
  I guess I can have the template be sensitive to an obscure URL parameter instead of logged in state.
  
  Any other ideas?
  
  ---
  
  ## Update 1
  
  FWIW the param approach works fine, so that:
  
  ```
  @web/path/to/json
  
  ```
  
  …renders nothing but…
  
  ```
  @web/path/to/json?myWeirdParamName=obscureValue
  
  ```
  
  …renders the data.
  
  So I point Feed Me at the latter.
  
  ---
  
  ## Update 2
  
  I just found the docs section on configuring [requestOptions](https://docs.craftcms.com/feed-me/v4/get-started/configuration.html#example-requestoptions), which suggests to me that there is a way to have Feed Me be governed by authentication, but I'm too dumb to make sense of what it might be trying to tell me.
  
  Can someone help me join the dots?
  
  **Tags:** plugin-feedme, security
  
  > **Comments:**
  > **username_1**: `requestOptions` is passed directly onto Guzzle, which will use HTTP basic auth headers. So you should be able to secure the feed with HTTP basic auth via .htaccess/nginx confi/etc.  
  > **username_1**: Caveat: I've never tried it myself.  
  
  ---
  
  ## 0 answers
  
  