DeepSeek Harness (DSH) Plugin: dsh-web-auth
The DSH web process binds to 127.0.0.1 by default, and access exposed via frp is blocked by the host trust fence. The dsh-web-auth plugin runs a reverse proxy inside the DSH process to provide token login and HttpOnly session management for public internet access. It supports token login, cookieless access, WebSocket pass-through, and IP rate limiting for consecutive failures. Installation requires adding the repository to bundles and generating a token file. Configuration is optional, and it listens on port 3081 by default. During deployment, frpc must be used to forward traffic to this gate port. The plugin has zero external dependencies and uses a fail-closed mechanism to ensure the security of the DSH core.
Read Moredsh-web-auth: Add Transport Layer Authentication for DeepSeek Harness Web GUI
`dsh-web-auth` is a DeepSeek Harness (DSH) plugin used to establish an authentication boundary at the transmission layer of the Web GUI. It functions by disabling the default webserver and inserting an authentication gateway to ensure that HTTP routes and WebSocket/HTTP upgrade paths are authenticated before the request reaches the application. The plugin supports two modes: `always` and `non-loopback`, and by default enforces login for all requests (including local loopback). Security features include using scrypt hashing for password storage, in-memory session token management (with sliding TTL), setting secure HttpOnly/SameSite cookies, IP-based login attempt limiting, and Origin...
Read More