dsh-web-auth

DSH Web GUI binds to the loopback interface by default. The moment you put a reverse proxy in front of it or open the port to a LAN, the service is completely exposed. dsh-web-auth closes that gap: every HTTP request, WebSocket upgrade, SSE stream, and static asset must carry a valid session, and unauthenticated visitors are redirected to a login page before they see anything else.

The plugin handles the full day-to-day authentication lifecycle. Passwords are stored as salted scrypt hashes on disk. Sessions ride on an HMAC-SHA256-signed HttpOnly cookie with a seven-day sliding expiry. Login and password-change endpoints enforce per-IP rate limiting with exponential backoff (five consecutive failures lock for one minute, scaling up to thirty). Changing the password rotates the signing key and instantly invalidates every active session. On the server side the plugin also performs the DSH bootstrap token exchange automatically, so external devices and new browsers no longer need to visit the printed token URL by hand. A settings card lets you hot-switch the listen address between localhost and all network interfaces without restarting the process.

This plugin is designed for anyone who reverse-proxies DSH to the public internet, shares the Web GUI across a team network, or simply wants a basic authentication gate in front of the admin interface. Keep in mind that authentication is access control, not a security boundary: pair it with a reverse-proxy WAF and IP allowlists in production, and set the password as soon as possible after installation, since the bootstrap window allows the first visitor to claim it.