imchenmin/dsh-auth-lock

README 摘要

dsh-auth-lock English 中文 Host-side password authentication for DeepSeek Harness Web deployments. It applies one authentication policy to the DSH API, SSE, WebSockets, and server routes registered by third-party plugins. dsh-auth-lock is a dual-face DSH plugin: the Host entry owns password verification, Cookie sessions, and WebServer policy; the browser entry owns first-run setup, login, password changes, automatic locking, and responsive presentation. [!IMPORTANT] This plugin requires the DSH WebServer Cordis waterfalls webserver/request and webserver/upgrade . On an older DSH build, Auth Lock stays inactive and registers no authentication policy, while DSH continues to start normally. The page and Host log explicitly state that no authentication is active and show the uninstall command dsh plugin --profile web remove dsh-auth-lock . Features - First-run setup is loopback-only by default, preventing remote takeover of a new instance. - 4–16 character passwords with no complexity rule; numeric PINs are accepted. - Node scrypt password derivation with N=32768 , r=8 , p=1 , and a random 128-bit salt. - Constant-time verifier comparison through timingSafeEqual ; plaintext passwords are…

分类