DeepSeek Harness (DSH) Plugin: dsh-web-auth
The DSH web process binds to 127.0.0.1 by default, and access exposed via frp is blocked by the host trust fence. The dsh-web-auth plugin runs a reverse proxy inside the DSH process to provide token login and HttpOnly session management for public internet access. It supports token login, cookieless access, WebSocket pass-through, and IP rate limiting for consecutive failures. Installation requires adding the repository to bundles and generating a token file. Configuration is optional, and it listens on port 3081 by default. During deployment, frpc must be used to forward traffic to this gate port. The plugin has zero external dependencies and uses a fail-closed mechanism to ensure the security of the DSH core.
Read Moredsh-web-auth: Password Gate and Reverse Proxy Authentication for DSH Web
`dsh-web-auth` is a security plugin for DSH Web that provides site-wide access control via a login page and an HttpOnly signed cookie, with support for WebSocket and reverse-proxy environments. It includes brute-force protection, session management, remote settings unlocking, and listening-address switching, and stores password data encrypted using scrypt. After installation, you must set a password immediately and enable remote settings via SSH port forwarding or a configuration file to reduce the risk of exposing the web interface directly to the public internet.
Read Moredsh-web-auth: Add Transport Layer Authentication for DeepSeek Harness Web GUI
`dsh-web-auth` is a DeepSeek Harness (DSH) plugin used to establish an authentication boundary at the transmission layer of the Web GUI. It functions by disabling the default webserver and inserting an authentication gateway to ensure that HTTP routes and WebSocket/HTTP upgrade paths are authenticated before the request reaches the application. The plugin supports two modes: `always` and `non-loopback`, and by default enforces login for all requests (including local loopback). Security features include using scrypt hashing for password storage, in-memory session token management (with sliding TTL), setting secure HttpOnly/SameSite cookies, IP-based login attempt limiting, and Origin...
Read Moredsh-auth: Add Admin Login for DeepSeek Harness Web
dsh-auth is a non-official community plugin for DeepSeek Harness (version 0.2.3), designed to add secure HTTPS administrator login for the DSH Web application running exclusively on the local loopback address. Maintained by hxy91819, the core mechanism involves introducing the project's Caddy `forward_auth` edge service to uniformly intercept requests for pages, APIs, downloads, SSE, and WebSocket connections, ensuring access security when not logged in. Its core capabilities include: support for interactive or non-interactive JSON configuration; password or login token storage via Argon2id hashing to avoid plaintext storage; automatic TLS certificates by default to enable HTTPS; and independent execution of `dsh-auth-caddy.service`.
Read Moredsh-web-startup-auth: Securely Exposing the DSH Web Interface on Local Networks
dsh-web-startup-auth is a DSH networking tool plugin maintained by GDWhisper. It replaces the original web launcher, enabling `dsh web --host 0.0.0.0`, and includes login/registration pages along with session protection to ensure that API and RPC require valid sessions for remote access. The plugin takes effect automatically through bundle patches, storing credentials in `~/.dsh/web-auth.json`. It is suitable for sharing the DSH interface on trusted internal networks; for plaintext HTTP scenarios, it is recommended to use it with an HTTPS reverse proxy.
Read More