something like:
"api-key" : "this-is-my-secret-it-must-be-included-in-all-API-calls-when-active".
I always hate when people use user/password when there is only one possible username so I think key works fine.
I would like to publicly host my monitoring webpages along with database for historical performance, etc. For privacy reasons I would prefer to put this on a webserver unrelated to my physical location/IP.
Also ANUBIS and "cgminer web monitor" seem to be popular but can be tough for newbies to setup. With breaking version changes staying up to date can add to workload. The authors could provide public hosting (as a paid service) but some level of security would be a good idea before punching holes in firewalls. IP Address limiting works but is harder to manage.
I don't image this being very difficult to implement:
a) api-key is off by default.
b) if api-key is set then any RPC call needs to include the key as a JSON parameter or the call fails.
Your thoughts?