dsh-gateway

DeepSeek Harness Web intentionally ships without authentication. The official docs state that the browser-trust fence is for DNS-rebinding prevention only and explicitly note that it is not authentication. The recommended hardening path is to place a real reverse proxy in front. dsh-gateway implements exactly that as a harness plugin: once installed it handles all authentication on its own port while harness itself stays bound to loopback.

On the gateway port nothing is reachable without authentication. There is no health endpoint and no static-asset bypass; pages and assets get 302-redirected to the login page, API requests return 401, and WebSocket upgrades are denied. On first visit the login page guides you through setting a password; afterward you can change it from the dedicated Security page under Settings, and any modification immediately invalidates all active sessions. Password comparison uses SHA-256 with a constant-time check, and failed logins are rate-limited per source IP (default: 5 consecutive failures trigger a 30-second cooldown). Sessions are backed by HMAC-SHA256 signed stateless cookies whose signing key is generated randomly at every process start, so a restart forces everyone to log in again by design.

This plugin is for anyone who needs to expose DeepSeek Harness Web to a LAN or wider network without standing up and maintaining a separate Caddy or Nginx instance. If your deployment is strictly loopback-only and the trust boundary is already sufficient, you likely do not need it.