Preface

The official Web profile of DeepSeek Harness (DSH) does not enable access authentication by default. This is usually acceptable for local development environments. However, in scenarios requiring stricter access control, you can add optional local token and Cookie-based access authentication to the Web profile by installing a plugin. The plugin is maintained by qipenglin and licensed under MIT.

Installation and Enablement

After installing the plugin, you must restart the Web Profile for it to take effect.

dsh plugin --profile web add github:qipenglin/dsh-web-access
dsh web

Usage Flow

After restarting, running dsh web outputs only a link containing a fragment token. Use the full link to open the page for the first time.

Before the first asynchronous operation, the browser clears the address-bar fragment, exchanges it for a host-only, HttpOnly, SameSite=Strict session Cookie using the Bearer token, and then starts the DSH Connection. In subsequent uses within the same browser session, you can open the bare address without a token directly.

Security and Authentication Mechanism

The plugin mandates that the WebServer must bind to 127.0.0.1; using --host 0.0.0.0 will cause startup to be rejected.

For secure behavior, the following resources remain public to allow parallel browser startup and authentication:
* Static HTML
* shell resources
* boot manifest
* /plugins Client bundle
* /plugins/events HMR graph metadata

For sensitive paths and connections:
* Anonymous access to /api, custom Connection RPC channels, and the two downstream Connection WebSocket links all return 401.
* Mismatched Host, Origin, or Fetch Metadata returns 403.
* A new token, Cookie name, and session secret are generated at every process startup; old Cookies become invalid after a restart.

Host-Side Integration

After installation, the Host side exposes ctx.webAccess for the desktop runtime to use. If this service is unavailable, the desktop runtime decides whether to fall back to a bare loopback service.

Notes

  • Version Compatibility: The current version is only compatible with the official DSH 0.1.1-rc.2.
  • Deployment Scope: The plugin only secures the local Web profile and does not support LAN or public network deployment.
  • Startup Failure Handling: After installation, if version checks, binding, or assembly fail, the profile will fail to start directly and will not automatically downgrade to an unauthenticated service in the same startup attempt.
  • Uninstall: After uninstalling and restarting, the Web profile restores the unauthenticated behavior of official 0.1.1-rc.2.

Ecosystem Context

DeepSeek Harness (DSH) follows the “everything is a plugin” philosophy, and the community maintains a separate plugin catalog. The plugin introduced in this article is part of that community ecosystem and has no official affiliation with DeepSeek or Huanfang.

The plugin enhances the security of the DSH Web profile by enforcing local authentication and fine-grained HTTP/WS-layer protections. If you want more details or to provide feedback, visit its GitHub repository.

  • Catalog Page: https://www.skillhub.cn/plugins/qipenglin/dsh-web-access
  • GitHub: https://github.com/qipenglin/dsh-web-access