dsh-auth-lock

A DeepSeek Harness Web deployment ships with no built-in authentication layer, so anyone who discovers the address can call the API, follow SSE streams, connect to WebSockets, or invoke server routes registered by third-party plugins. dsh-auth-lock plugs into the WebServer policy extension point and applies one password-authentication policy across HTTP, SSE, WebSocket, and dynamically registered plugin routes automatically.\n\nOn the security side, passwords are derived with scrypt (N=32768, r=8, p=1, random 128-bit salt) and verified through constant-time comparison to defeat timing side-channels. Session tokens are 256-bit random values; the Host retains only their SHA-256 digests in memory. Cookies are HttpOnly and SameSite=Strict, with Secure attached automatically over TLS. Remote addresses are limited to eight failed attempts per fifteen-minute window, and derivation work for a single address runs serially to slow brute-force. First-run setup is loopback-only by default so a fresh instance cannot be remotely hijacked, and after a successful login the page reloads or returns to the original route so API, SSE, and WebSocket clients pick up the new cookie seamlessly.\n\nIt is a single-user, zero-runtime-dependency plugin by design: no multi-user accounts, roles, OAuth/OIDC, or clustered sessions. If you run DSH Web behind a LAN, SSH tunnel, or reverse proxy and simply need a 4-to-16 character password to lock down the entire WebServer surface, this is a drop-in solution with a responsive login UI and a built-in password management panel.