Introduction

DSH’s plugin mode breaks Web service capabilities into composable bundles. If your DSH deployment requires adding authentication to the Web service, without relying solely on the browser’s native authentication popup, and without sacrificing access methods for curl, CLI tools, and automated API clients, here is dsh-plugin-auth-webserver.

This plugin is a native Web authentication bundle for DeepSeek Harness (DSH). It provides a DSH-themed web login page, HMAC cookie sessions and logout, a Web GUI settings card, dual-mode authentication and WebSocket protection, HTTP Basic Auth fallback, remote IP privileged RPC trust delegation, and a Web Crypto UUID auto-polyfill, and supports English and Simplified Chinese.

What is it

  • Plugin Name: dsh-plugin-auth-webserver
  • Positioning: Native Web authentication bundle for DSH
  • GitHub Repository: https://github.com/kolawong/dsh-plugin-auth-webserver
  • License: MIT © 2026 kola

Core Features

The capabilities listed below are derived from the plugin’s verified description:

  • DSH-themed web login page: Provides a DSH-styled Web login page.
  • HMAC cookie sessions and logout: Maintains sessions using HMAC cookies and supports logout.
  • Web GUI settings card: Provides a settings card in the DSH Web GUI.
  • Dual-mode authentication and WebSocket protection: Provides dual-mode authentication and WebSocket protection.
  • HTTP Basic Auth fallback for CLI tools, curl, and automated API clients: Reserves HTTP Basic Auth fallback for CLI tools, curl, and automated API clients.
  • Remote IP privileged RPC trust delegation: Supports remote IP privileged RPC trust delegation.
  • Web Crypto UUID auto-polyfill: Provides a Web Crypto UUID auto-polyfill.
  • English and Simplified Chinese: Supports English and Simplified Chinese.

Installation and Enablement

When installing via the git-host method, you can specify a commit:

dsh plugin --profile web add github:kolawong/dsh-plugin-auth-webserver#<commit-sha>

Replace <commit-sha> here with the specific commit hash you wish to install.

After installation, start the web profile:

dsh --profile web

Then open:

http://your-server-ip:3080

to see the login page.

Configuration

You can override the webserver-auth line through your own profile patch. The file path is:

$DSH_HOME/profiles/web/cordis.patch.yml

Fields to override include:

- id: webserver-auth
  config:
    host: <host>
    port: <port>
    username: <username>
    password: <password>

The default value for password is ''; leaving it empty will disable authentication.

If you modify the configuration in the settings card of the Web GUI, the state will be saved to:

$DSH_HOME/plugins/dsh-plugin-auth-webserver/state.json

The file permissions are 0600.

Environment variables DSH_AUTH_USER and DSH_AUTH_PASS will override both the configuration file and the saved state.

API endpoints

The plugin provides the following interfaces:

POST /api/auth.login
POST /api/auth.logout
GET /api/auth.get
POST /api/auth.update

Use Cases and Notes

Suitable for the following usage scenarios:

  • Adding a Web login page to DSH Web services.
  • Using HMAC cookie sessions and logout capabilities.
  • Managing authentication configuration via a Web GUI settings card.
  • Allowing Web forms, cookie sessions, and HTTP Basic Auth to coexist.
  • Reserving Basic Auth fallback for CLI tools, curl, and automated API clients.
  • Requiring WebSocket protection.
  • Requiring remote IP privileged RPC trust delegation.
  • Requiring a Web Crypto UUID auto-polyfill.
  • Requiring English and Simplified Chinese interfaces.

Usage notes:

  • The plugin runs with the permissions of the current dsh process.
  • You should check the source code and license before installation.
  • This plugin depends on the following peer dependencies:
@deepseek-ai/cordis >=4.0.0
@deepseek-ai/schemastery >=3.0.0

Conclusion

The value of dsh-plugin-auth-webserver lies in breaking the authentication capabilities of the DSH Web service into an independent bundle: providing a Web login page, cookie sessions, Web GUI settings, Basic Auth fallback, WebSocket protection, remote IP RPC trust delegation, and Web Crypto polyfill all within the same plugin.

GitHub Repository:

https://github.com/kolawong/dsh-plugin-auth-webserver