SummerSec/dsh-web-auth

README excerpt

dsh-web-auth Transport-level authentication for the DeepSeek Harness (DSH) Web GUI. Official DSH webserver serves the GUI, plugin bundles, /api , SSE, and WebSocket traffic without a login boundary. This plugin disables that unauthenticated carrier and replaces it with a drop-in webServer service that authenticates every request before it reaches application routes. 中文文档：README.zh-CN.md Login page Why this exists DSH’s stock web host is convenient for local use, but it is not a product auth layer: - Binding to 0.0.0.0 or putting the port behind a reverse proxy can expose the full control surface. - A frontend-only “login page” does not protect /api , static plugin assets, SSE, or WebSocket upgrades. - Session and password handling need to live on the HTTP carrier itself. @summersec/dsh-web-auth sits at the transport layer: 1. Disable @deepseek-ai/dsh-host-webserver . 2. Insert webserver-auth with the same ctx.webServer contract ( register , registerUpgrade , registerFallback , tapIndex , host , port ). 3. Gate HTTP and upgrade traffic with a server-side session cookie. Other plugins keep registering routes as usual; they do not need to know auth exists. Features Area Behavior Cover…

Category