Skip to content

TinyWebUI v0.1.4

Latest
Latest

Choose a tag to compare

View all tags
@MarcellM01 MarcellM01 released this 09 Oct 08:15
· 1 commit to main since this release
v0.1.4
ae7f24f

No more password prompt on first run

npx tinywebui now starts without asking you to create a password. The terminal prints a sign-in link instead:

[tinywebui:server] sign in: http://127.0.0.1:7777/#token=…

Open it and your browser stays signed in, including across restarts. Only someone who can read that terminal can get in. Other programs and users on the same machine that try the port are refused. The token changes every time the server starts.

What still needs a password

  • Listening on the network. Starting with --host 0.0.0.0 or any non-loopback address still refuses to run until you set a password with tinywebui set-password or TINYWEBUI_PASSWORD. Docker is unchanged, because the container listens on a network interface.
  • If you already have a password, nothing changes: you keep signing in with it, and the link does not work.

DNS-rebinding protection for authMode: "none"

With login turned off, TinyWebUI now answers only to loopback host names (localhost, 127.0.0.1, [::1]). This stops a malicious website from pointing its own domain at your machine and using the chat UI and its tools through your browser. To reach a no-login install by another name, add it to the new allowedHosts setting in tinywebui.config.json.

Upgrading

No action needed. Configs with a password keep working as before. Configs without one now use the sign-in link on loopback and still refuse to start on a network address.

Full Changelog: v0.1.3...v0.1.4

Assets 2
Loading