zephaniahwang94-cmyk/dsh-auth-gate

README 摘要

dsh-auth-gate English 中文 Authentication and security hardening plugin for DeepSeek Harness. Security Risks in Public Network / Docker Deployment DeepSeek Harness is designed as a local development tool . Its default security model relies on loopback binding ( 127.0.0.1 ) and request header validation (Host / Origin / Sec-Fetch-Site). This model breaks down in several common deployment scenarios: Scenario 1: Docker container deployment Important correction : EXPOSE alone exposes nothing, and Docker port publishing cannot normally reach a process bound only to the container's loopback interface. The risk appears only when DSH is configured/patched to bind 0.0.0.0 , or when another process inside the container proxies a container-facing port to DSH. Publishing that port without host-IP restriction (for example -p 3080:3080 ) then exposes the full Agent control plane to reachable networks. Root cause : No authentication layer. The trust fence only validates request headers, not caller identity. Scenario 2: Reverse proxy (Nginx / Caddy) Risk : The reverse proxy forwards Host and Origin headers from the client. The trust fence sees matching headers and allows the request. Anyone who can …

分类