Introduction

The DeepSeek Harness (DSH) Web UI needs additional protection in production environments. Existing login gate solutions are often complex or dependency-heavy. dsh-simple-auth provides a straightforward alternative: access control via a shared key or owner/guest keys, with ACL-based session isolation and sharing.

Plugin Overview

dsh-simple-auth is a DeepSeek Harness Web plugin maintained by lt9. It is an ultra-lightweight login gateway with a core design goal of zero production dependencies.

The plugin provides a single login field and supports optional “owner key” or “guest key”. By default, sessions are isolated; only the “owner” can share or unshare a session. The sidebar list is filtered by ACL, and a floating action button (FAB) in the bottom-right corner is dedicated to sharing the currently selected session.

Installation and Enablement

Add the plugin using the DSH plugin manager:

dsh plugin --profile web add github:lt9/dsh-simple-auth

If the current profile is a pnpm workspace and you encounter the ERR_PNPM_ADDING_TO_ROOT error when adding it, use the -w flag:

dsh plugin --profile web add -w github:lt9/dsh-simple-auth

Install from a local checkout:

dsh plugin --profile web add ./dsh-simple-auth

You must set a key before enabling the plugin. It follows a “fail-closed” policy: if the key is missing, the login page will indicate this, and all other requests will be denied.

export DSH_SIMPLE_AUTH_KEY='a-long-random-secret'

For systemd or Docker services, put the same variable in Environment or EnvironmentFile. If you need to reuse an existing environment variable, specify keyEnv in the configuration:

# $DSH_HOME/cordis.patch.yml
- id: dsh-simple-auth
  config:
    keyEnv: EXISTING_SECRET_ENV

After restarting the DSH Web process, open the UI and enter the key.

Configuration

The following are verified configuration options. All options are optional, and defaults are provided by the code. When configured in cordis.patch.yml, the config of the home-layer patch completely replaces the default configuration; deep merging is not supported.

Option Default Description
keyEnv DSH_SIMPLE_AUTH_KEY Environment variable name that stores the access key
keyFile "" If set, read the key from this file (leading and trailing whitespace is trimmed); takes precedence over keyEnv
cookieName dsh_simple_auth Session cookie name
sessionTtl 604800 Cookie TTL (seconds); default is 7 days
cookieSecure auto auto follows X-Forwarded-Proto; true or false forces the Secure flag
rewriteLoopback true Rewrite authenticated traffic to 127.0.0.1:<port> to avoid DSH reverse-proxy Host checks blocking privileged APIs
title DeepSeek Harness Login page title
remember true Show the “remember key on this device” option (stored only in localStorage; the server still uses cookies)
rpcMinTimeoutMs 120000 Minimum value injected into the Web Index for AbortSignal.timeout. The default DSH RPC timeout is 30s; large pages may abort. Set to 0 to disable

Security and Notes

  • Fail-closed: Misconfiguration does not expose the UI. If the key is missing or misconfigured, all requests are denied.
  • Rate limiting: Login attempts are rate-limited per client IP.
  • Session sharing mechanism: Sharing a session means sharing a “live agent,” not just the chat text. This means credentials, bash, workspace, and settings remain shared at the machine level.
  • Not a TLS replacement: This plugin only provides access control; it cannot replace TLS, and agents should still be treated as remote code execution. Do not expose DSH in cleartext on the public internet.
  • Catalog listings: Catalog listings are for display only and are not a security audit.