Security & Access Control

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• wikispeech_server/wikispeech.py
• workflow_demo/README.md
• wikispeech_server/hanna-clockwork.conf
• wikispeech_server/config.py

The Wikispeech server implements security and access control through a combination of web server configuration, Cross-Origin Resource Sharing (CORS) policies, and network-level proxying. The primary objective is to restrict unauthorized access to generated audio assets while enabling seamless integration between the main synthesis server and distributed microservices such as lexicon and mapping servers.

Cross-Origin Resource Sharing (CORS)

The Wikispeech server is built using the Flask framework and utilizes the flask_cors extension to manage cross-origin requests. By default, the application initializes CORS to allow requests from different origins, which is necessary for the server to function within a microservices architecture where the frontend demo or external callers might reside on different domains or ports.

app = Flask(__name__, static_url_path='')
CORS(app)

Sources: wikispeech_server/wikispeech.py:82-83

Apache-Level Access Control

When deployed behind an Apache HTTP Server, specific security measures are recommended to protect the directory containing temporary audio files. Access control is primarily handled via .htaccess files or Apache configuration blocks to prevent unauthorized directory listings and restrict access to specific file types.

File Type Restrictions

To prevent unwanted access to sensitive files or system data within the temporary audio directory (audio_tmpdir), configuration is provided to deny all access by default and explicitly allow only .opus files.

Restriction Type	Implementation Detail	Purpose
Global Deny	Deny from all	Block access to all files in the tmp directory by default.
Whitelisting	Allow from all for .opus	Permit public access only to generated audio files.
Directory Listing	index.html placement	Prevent users from browsing the contents of the audio cache.

Sources: README.md:105-118

The following flowchart illustrates the access check performed by the web server for audio assets:

Microservice Authentication and Proxying

The Wikispeech architecture involves multiple internal services (lexicon, mapper, marytts). To resolve access control issues encountered when a client tries to contact these services directly (e.g., from a browser-based workflow demo), the Wikispeech server acts as a trusted proxy.

Lexicon Server Proxying

A significant security design choice was made to route lexicon lookups through the Wikispeech server. This avoids Cross-Origin issues and allows the main server to act as a security gateway for the lexicon database.

• Internal Routing: If localhost is serving the test page, external services like morf.se cannot be used directly for lexicon lookup due to browser access control policies.
• Proxy Endpoint: The endpoint /lexserver/<path:url> enables the Wikispeech server to forward requests to the lexicon host defined in the configuration.

@app.route('/lexserver/<path:url>')
def lexserver_proxy(url):
    lexicon_host = config.config.get("Services","lexicon")
    redirect_url = "%s/%s%s" % ((lexicon_host, url, "?" + request.query_string.decode("utf-8") if request.query_string else ""))
    log.info("Lexserver proxy to: %s" % redirect_url)
    req = requests.get(redirect_url, stream = True)
    return Response(stream_with_context(req.iter_content()), content_type = req.headers['content-type'])

Sources: workflow_demo/README.md:31-36, wikispeech_server/wikispeech.py:610-617

Configuration and Environment Security

Access control settings are managed through a tiered configuration system. The server checks for a default configuration and then overrides it with user-specific or hostname-specific files to ensure that local environment secrets or specific port settings are not leaked or generalized.

Configuration Hierarchy

1. Default: wikispeech_server/default.conf
2. User-Specific: wikispeech_server/<username>-<hostname>.conf
3. Command Line: Explicitly provided configuration file argument.

Sources: wikispeech_server/config.py:10-35

Critical Service URLs

Configuration files define the location of internal services. Security relies on these services being hosted on localhost or behind a protected network where the Wikispeech server is the only permitted caller.

Service	Default URL	Usage
Lexicon	http://localhost:8787	Sensitive word definitions and transcriptions.
Mapper	http://localhost:8771	Symbol set mapping.
Matcha/Piper	http://localhost:8009/8010	TTS engine endpoints.

Sources: wikispeech_server/hanna-clockwork.conf:20-25

Conclusion

Security in the Wikispeech server project is characterized by a "proxy-centric" model. By funneling client requests through the main Flask application and utilizing standard web server tools like .htaccess, the system ensures that internal TTS microservices remain shielded from direct public exposure while maintaining the flexibility required for a distributed speech synthesis environment.