Users and security

Without users, anyone on your local network who can open the app has full access, and every page shows a reminder. Requests from outside the local network (the internet, also through a reverse proxy) are refused until an administrator exists, so an app published by mistake is not open to everyone. Open Users and create an administrator to require a login; you are logged in as that administrator right away. Then add more users with one of two roles:

Role	Can
Administrator	Everything: synchronize, organize, compress, ignore items, change settings and manage users
Read only	Browse the library and download files; the controls that change something are hidden

• Passwords are stored as bcrypt hashes in users.json in the data folder. Every user can change their own password in My account; a new password ends the other sessions of that user. A password needs at least 10 characters and cannot be a very common one or the user name.

• Logins last 30 days; Log out ends the session for good, also on a copied cookie.

• Protection against brute force and bots (a botnet trying lists of user names and passwords): after a few failed logins each attempt is slowed down a little, and after 10 the address and the account are blocked, so guessing one account from many addresses, or many accounts from one address, are both stopped. The block grows with each further failure (up to a day for an address, an hour for an account), and a flood from many addresses at once slows every attempt. Behind a reverse proxy the real client address is used, not the proxy's, and forged forwarded addresses from outside the local network are ignored.

• An administrator can also be set with the environment variables SLM_AUTH_USERNAME and SLM_AUTH_PASSWORD, which is useful when a password was forgotten. A weak SLM_AUTH_PASSWORD (shorter than 10 characters or very common) still works, so nobody is locked out, but the log and the pages of the administrators ask to change it.

• If another service already protects the app (a reverse proxy with its own login, a VPN) and you want no users, set SLM_ALLOW_REMOTE_WITHOUT_LOGIN=true so it also answers outside the local network.

• Without login the app answers only to addresses (192.168.1.2:3030), names without a domain (tower:3030) and names of the local network (.local, .lan, .home.arpa, .internal, .ts.net…), so a web site cannot point a name of its own at the app and use it (DNS rebinding). To open it by another name, list it in SLM_ALLOWED_HOSTS (names separated by commas, .example.com for every name under a domain).

Use HTTPS (for example behind a reverse proxy) when the app can be reached from outside your network: the app then marks its cookies as secure and tells the browser to keep using HTTPS.

Behind Cloudflare. With a Cloudflare Tunnel (cloudflared on your network) nothing needs to be set: the app reads the visitor's address from Cloudflare's CF-Connecting-IP header, so the login protection blocks the attacker and not Cloudflare. If Cloudflare connects to the app directly (a proxied DNS record pointing at your public address), set SLM_TRUSTED_PROXIES=cloudflare so its headers are believed only from Cloudflare's addresses. SLM_TRUSTED_PROXIES also takes other proxy addresses or ranges, separated by commas. Cloudflare's own protections (for example a WAF rate limiting rule on /login.html, or Cloudflare Access) can be added on top.

Verifying the downloads. Every program of a release and every Docker image comes with a signed provenance (Sigstore, through GitHub) that proves it was built by this repository's workflows from the tagged source, and the images carry the list of what is in them (SBOM). With the GitHub CLI:

gh attestation verify switch-library-manager-web-<version>-windows-x64.zip -R DeLFuS77/switch-library-manager-web
gh attestation verify oci://docker.io/delfus77/switch-library-manager-web:latest -R DeLFuS77/switch-library-manager-web

SHA256SUMS.txt in each release has the checksums of the files.

To report a security problem privately, see SECURITY.md.

To report bugs, ask for features or contribute code, see CONTRIBUTING.md.

Other protections: other web sites cannot send actions to the app (CSRF), pages cannot be shown inside other sites, only the app's own scripts run, request sizes and slow connections are limited, covers are only downloaded from the internet (never from addresses of your network) and the settings, users and session files are readable only by the app.