dsh-ui-auth

DSH Web UI is designed for local use and ships without an authentication layer. Once the panel is exposed to a shared network or the public internet, anyone can call its APIs, read model configurations, or even modify API keys. dsh-ui-auth wraps the underlying node:http server with a session check that fires before all route dispatch: every /api/ endpoint (RPC, SSE, downloads), /plugins/ front-end modules, HMR, SPA fallback, and both WebSocket upgrade channels are covered with no bypass. Unauthenticated page requests receive a 302 redirect to the login page, API and static assets return 401, and WebSocket upgrades are destroyed immediately. After a successful login the original request passes through untouched, so existing functionality is completely unaffected.

Authentication goes well beyond a password. The plugin ships a styled Chinese login page with HttpOnly + SameSite=Strict cookies and 12-hour sliding renewal. It supports TOTP two-factor authentication (RFC 6238, compatible with Google and Microsoft Authenticator, with QR-code and otpauth URI import, plus a password-free TOTP-only login mode). New users register with an email, username, password, and an admin-generated invite code, then land on the TOTP onboarding page. The user-management panel separates regular-user and admin permissions: admins can add or remove users, reset passwords, toggle roles, generate and revoke invite codes, and strip any user’s TOTP token, while built-in guards prevent accidental lockout (the last admin cannot be demoted, a user cannot delete themselves). Every sensitive action is written to a JSONL audit log, and sessions persist to disk so that a panel restart does not force re-login.

This plugin is a fit for teams or individuals running DSH behind a shared LAN, remote office, or public reverse proxy, as well as anyone who wants an extra safety net against accidental port exposure or DNS-rebinding attacks. It installs and uninstalls through the standard DSH bundle mechanism, requires only the pure-JS qrcode dependency at runtime, and makes zero modifications to DSH’s core code paths.