dsh-webui-auth

Exposing DSH WebUI to a public or shared environment leaves it without any login gate by default—anyone can load the interface, call core APIs, and establish real-time connections. This plugin fills that gap: unauthenticated browsers cannot touch any WebUI resource, API, or WebSocket, with authentication enforced at the HTTP and transport layers so it cannot be bypassed via browser dev tools.

It patches no DSH core packages. Instead, it wraps routes at runtime to cover all four layers—static assets, plugin bundles, /api RPC, and WebSocket. If route wrapping is incomplete at startup, it refuses to enable authentication, preferring no login over naked APIs. Sessions persist to disk, so logged-in devices survive DSH restarts, and changing the password revokes all other sessions.

Security details are solid: passwords hashed with scrypt, per-IP login rate limiting with username enumeration protection, HMAC-pseudonymized IPs in audit logs, and HttpOnly + SameSite=Lax cookies. First-time initialization requires a per-boot setup token to prevent pre-config hijacking. Both the login page and settings panel follow DSH's theme for a consistent look.

It is ideal for users who run DSH WebUI behind a reverse proxy, on a LAN, or exposed to the internet, and who want robust access control without modifying core source code or leaving security gaps after upgrades.