I have set up a custom webserver hosted on a Raspberry Pi on my home local network. The web app requests a single web page from the server via HTTP, and then sends user commands and receive information via websockets.
For now, I have only used the app within my (cable) local network and there is no security implemented at all, but I want to open the port to the Raspberry in my router to be able to connect from the outside world.
My requirements are that:
- Commands should not be sent by someone without credentials
- System information should not be read by someone without credentials
What should I set up to achieve such requirements? Is SSL required? If yes, could I use a self-signed certificate?