How to use dsh-webui-auth

This article is derived from the plugin's already-indexed fields (wiki / faq / compatibility_json / readme), not freshly generated by AI. Source field is noted at the end of each section.

Quick start

WebUI authentication enforced at the HTTP/transport layer: four-layer login gate (resources, plugin bundles, /api, WebSocket), server-side sessions with HttpOnly cookies.

— source: plugins.ai_summary

Install & verify

dsh plugin --profile web add dsh-webui-auth

Run the command above in your DSH Web Profile. Then enable the plugin in the plugin list.

— source: plugins.install

Key points

• 不修改核心包：dsh 升级不会覆盖补丁、不会产生「升级后 /api 裸奔」的窗口。插件每次启动对路由表重做包装，并用 2s→10s 重扫捕获晚注册路由。
• fail-closed：若预期路由缺失（dsh 内部结构变化导致包装不上），setup/configure 会拒绝启用认证，并在宿主日志与设置页同时报错——宁可不可用，不可「开了登录却裸奔 /api」。
• 反代/局域网下的特权方法：已认证请求由插件在会话校验后以「回环形状」转交核心，使核心中回环钉死的特权方法（settings/credentials/agentPreset/llm.discoverModels）在反代部署下可用——会话 Cookie 闸门是比 Host 启发式更强的身份证明。
• WebSocket 与 trustedHosts：WS 升级握手仍受核心自身 isTrustedApiRequest 限制，因此反代/局域网（非回环 Host）部署下，WS 下行需要同时在 dsh 配置中把对外域名加入 client-connection.trustedHosts，否则即使已登录也会被拒绝升级。
• • id: dsh-webui-auth

— source: plugin_wiki.readme_en (fallback readme_raw)

Pitfalls

Review the upstream repo before installing. This guide is auto-derived from indexed fields and may lag the latest release. If anything contradicts the official docs, treat the upstream source as authoritative.

— source: general rule