deepseek-harness-auth: A DSH plugin providing auth proxy and secure login for DeepSeek Harness
taichuy/deepseek-harness-auth
An out-of-tree auth bundle for DeepSeek Harness Web profile, protecting HTTP, RPC, SSE and WebSocket via a public auth proxy, with accounts, IP whitelist, captcha and session management.
deepseek-harness-auth is an authentication plugin built for DeepSeek Harness. It pins the WebServer to a random localhost port and runs a public auth proxy in the same process to protect all HTTP, RPC, SSE, and WebSocket requests. With it, remote access to Harness is no longer exposed; account/password, IP whitelist, captcha, and session management are all included, plus secure theme reuse. It solves the security risk of remote access lacking authentication and exposing sensitive RPC, letting developers safely expose Harness to browsers.
How to Install
dsh plugin --profile web add deepseek-harness-auth- Category
- Integrations & Connections
- Platform
- DSH Plugin
- Author
- taichuy
- Distribution
- Plugin
deepseek-harness-auth Key Features
deepseek-harness-auth Repo Summary
What Does It Do?
deepseek-harness-auth is a DSH plugin for DeepSeek Harness that provides an out-of-tree authentication bundle for the Web profile. It pins the WebServer to a random port on 127.0.0.1 and runs a single public auth proxy in the same process, protecting HTTP, SPA static files, RPC, SSE, and WebSocket upgrades behind authentication. It solves the security problem of exposing Harness's sensitive RPC to remote browsers, with core capabilities including account/password auth, IP/CIDR whitelist, captcha, session management, and secure theme reuse.
Core Features
- Auth proxy: all requests (HTTP, SPA, RPC, SSE, WebSocket) are forwarded to Harness only after authentication; fail-closed when no account is initialized.
- Password security: passwords hashed with Node.js scrypt, state directory permissions 0700, state files 0600, with lockout after consecutive failures (default 6 failures lock for 30 seconds).
- Whitelist management: default whitelist is empty, so both local and remote addresses must log in; CLI can add IP or CIDR (e.g., localhost normalized to 127.0.0.0/8).
- Captcha policies: can be disabled, always on, or on after failure; captcha is short-lived and single-use.
- Sessions & logout: browser holds a random HttpOnly, SameSite=Strict session token; changes to account/password/whitelist revoke old sessions; web client offers logout and an "Account & Security" page.
- Secure theme snapshot: login page reuses the --dsw-* colors and background from the last authenticated page in the same browser; new browsers get a system-light/dark default theme.
How to Use This Plugin?
After enabling the plugin in the DSH web profile, run the initialization command (interactively set account, password, and confirmation; password never appears in command-line args), then start dsh web and visit the auth proxy address printed in the terminal (default port 3080). Daily management uses CLI subcommands such as status, init, whitelist add/remove/list/clear, and revoke; alternatively, use the web sidebar logout or the settings page to manage whitelist and captcha policy. Changing the password requires verifying the current password first.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: taichuy/deepseek-harness-auth. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.