At Captive Portal Connect, our mission is to deliver secure and advanced network management solutions. We are dedicated to embracing technologies that adhere to our stringent standards of service and security. Today, we need to discuss a critical limitation within UniFi network systems and its influence on our captive portal services.
One of the fundamental challenges we face is the absence of a cloud API for UniFi devices. This limitation severely restricts our ability to manage guest accesses securely and complicates the integration of robust security protocols necessary for maintaining a secure network environment.
Moreover, the current necessity to open local API access through port forwarding introduces significant security risks. This method increases network vulnerability, exposing infrastructure to potential external attacks—an issue that is far from ideal and one we find unacceptable.
Given these constraints, we have decided to pause the development of our captive portal solutions for UniFi networks. Rushing to provide a service that cannot guarantee the security standards we uphold would be contrary to our core values. For those requiring immediate solutions, we suggest considering reliable open-source software such as UniFi Hotspot to set up their own captive portals.
We are optimistic that UniFi will develop and provide access to a cloud API, including robust Access Control Lists (ACLs), which would allow us to create secure and efficient network management solutions. A comprehensive cloud API would enable us to manage network accesses safely without compromising the security of your network infrastructure.
We appreciate your continued support and understanding as we navigate these challenges. Our commitment to delivering top-tier and innovative network management solutions remains unwavering, and we look forward to updating you on our progress.
Thank you for trusting us with your network management needs. Ensuring your network is not only operational but also secure and optimized for performance is our top priority.
Update (2024-07-01)
We thought we had made a breakthrough in confining API access by using the new (and, of course, undocumented) ‘hotspotoperator’ permission instead of a full-blown admin account. In the end, it didn’t work (kudos to @woodjme). Approving guests through UniFi’s External Portal Server still requires admin-level credentials and direct access to the console, so our UniFi captive portal service remains paused.
For the full technical background, including how the External Portal Server flow works and which open-source libraries can drive it, see On UniFi Captive Portals.