mward4
8ae1e1fafa
0.4.0 made the browser-session check opt-out, so a deployment whose whole point is "no trusted host, no token" started asking for the launch token on every new device — including a phone, where producing it is the friction the plugin exists to remove. The bypass itself was never in doubt and is unchanged: `disableAuth: true` still replaces `connection.admit`, `requestRejection`, `authorizeIndex` and `authenticatedUrl`. Measured on DSH 0.2.1-rc.2 over a non-loopback Host with no cookie: `GET /` answers 200 and a socket upgrade to `/api/remote.mux` answers 101. Only the default moved. `disableAuth: false` keeps 0.4.0's posture — the launch token, the 30-day cookie bound to the rewritten loopback authority, and the check.
37 lines
1.6 KiB
YAML
37 lines
1.6 KiB
YAML
# dsh-trustworthy — bundle layer
|
|
#
|
|
# Applied automatically when the package is installed as a profile bundle
|
|
# (package.json declares dsh.bundle.patch).
|
|
#
|
|
# The defaults below are the plugin's stated posture: the identity fence is
|
|
# disarmed, no process token or per-device pairing is required, the browser is
|
|
# granted the host's own isLoopback flag, and the APIs a non-secure page is
|
|
# denied are restored. Reachability is therefore the only access control — put
|
|
# the port behind something that authenticates on your behalf if it is exposed.
|
|
# To keep the harness's own browser-session check instead (the first visit is
|
|
# then the one-time launch token from the process log, exchanged for a 30-day
|
|
# cookie), set `disableAuth: false`. Override any key in your profile patch:
|
|
#
|
|
# - id: trustworthy
|
|
# config:
|
|
# disableAuth: false # keep the launch-token check; one token per device
|
|
# grantPairing: false # when dsh-remote-web-ui provides the pairing service itself
|
|
# spoofSocketAddress: true # also satisfy socket-based fences with no pairing path
|
|
# shimClipboard: false # unnecessary when you reach the harness over HTTPS
|
|
# shimRandomUuid: false # likewise
|
|
# shimPwa: false # skip the manifest and the installable-app metadata
|
|
#
|
|
# Set `enabled: false` to suspend the plugin without removing the bundle.
|
|
- insert:
|
|
- id: trustworthy
|
|
name: 'dsh-trustworthy'
|
|
config:
|
|
enabled: true
|
|
disableAuth: true
|
|
forceClientLoopback: true
|
|
grantPairing: true
|
|
spoofSocketAddress: false
|
|
shimClipboard: true
|
|
shimRandomUuid: true
|
|
shimPwa: true
|