dsh-auth-proxy

DSH Web GUI ships without an authentication layer, and the webserver listens on loopback by default. Exposing the port to a LAN feels risky, and patching source code to add a password is a maintenance burden. dsh-auth-proxy places a static-token login wall in front of dsh web: the host side holds an extra listening socket, unauthenticated requests see a built-in login page, and once the token is verified a stateless HMAC session cookie is issued while all HTTP and WebSocket traffic is forwarded to the original 3080 port over loopback. Removing the plugin restores everything; the webserver never changes.

Capabilities span everyday auth to experience customization. Token comparison uses SHA-256 with timingSafeEqual to prevent timing side-channels; session cookies are stateless and survive restarts, while changing the token takes every session down instantly. CIDR IP allowlists, per-IP fail lockout, and real-time hot-reloadable configuration are all included. The brand layer, when enabled, rewrites the page title, favicon, PWA manifest, and sidebar visuals on the proxy path only, leaving direct loopback access to 3080 untouched. The plugin also handles /remote prefix restoration for web-all remote-web-ui compatibility, a two-step interaction pattern for the settings dialog on narrow screens, and transform containing-block neutralization, so the settings panel actually works on mobile.

It is well suited for teams running DSH on a LAN who want a lightweight login gate without deploying a full SSO stack, and for individuals who want a rebranded Web UI with zero backend modification. Listening addresses are restricted to loopback and private ranges; binding to wildcard or public IPs is rejected at both save time and startup. External access should front the proxy with a TLS-terminating reverse proxy.