AndyYJF/dsh-lan-web-auth

README excerpt

dsh-lan-web-auth English 简体中文 Host plugin for DeepSeek Harness ( dsh --profile web ) that makes the browser GUI usable over the LAN and protects it with a password: 1. crypto.randomUUID polyfill — the GUI's RPC client mints request ids with crypto.randomUUID() , which browsers only expose in secure contexts (HTTPS or loopback). Plain-HTTP LAN origins ( 192.168.x.x , hostnames, ZeroTier IPs) are not secure contexts, so every /api call throws client-side ( crypto.randomUUID is not a function ), the session list never loads, and the GUI falls into the workspace-picker state. The polyfill is based on crypto.getRandomValues , which IS available on insecure origins. 2. Password authentication — wraps the page fallback, the /api prefix route, and the two WebSocket downlink upgrades ( /api/events.mux , /api/events.host ) with a cookie check. Unauthenticated visitors get a built-in login page; POST /api/auth/login with the correct password sets an HttpOnly cookie (30 days). Loopback hosts ( 127.0.0.1 / localhost / ::1 ) are exempt by default ( config.loopbackExempt ). Security & Risks Read this before exposing the GUI beyond your own machine. dsh web is a remote-control surface : the harnes…

Category