raomaiping-hash/dsh-rgate

README excerpt

dsh-rgate 中文 English A remote access login gate for the DeepSeek Harness Web UI. Put a password wall in front of the whole browser surface: anonymous visitors on a public (non-loopback) address see only a login page, and every /api RPC is refused until they authenticate. Why The Harness's built-in browser-trust fence ( trustedHosts ) is a DNS-rebinding defense, explicitly not authentication. Anyone whose Host header passes the fence can use the Web UI. This plugin adds the missing authentication layer for self-hosted deployments: IP scanners hit a login page instead of your agent. What it does - Full-page login wall — a gate script is injected into every index.html (via webServer.tapIndex ); unauthenticated non-loopback visitors are redirected to /rgate-login , a self-contained login page. - Complete /api gating — exact routes shadow the shipped /api prefix for all 52 unary RPCs plus /api/respond and /api/session.export . Loopback requests pass through; everything else needs a session cookie or gets 401 before the body is even parsed. - Cookie sessions — rgate session , HttpOnly + SameSite=Strict, 7-day in-memory sessions; logout and password change invalidate all sessions. - Login…

Category