dsh-plugin-auth

Configuration ($DSH_HOME/auth/config.json, optional)

All keys are optional; out-of-range or wrong-typed values silently fall back to the secure default, so a malformed file can never weaken the gate past sane bounds.

Key	Default	Meaning
sessionAbsoluteTtlMs	43200000 (12h)	Hard session lifetime cap.
sessionIdleTtlMs	7200000 (2h)	Sliding idle window.
sweepIntervalMs	300000 (5m)	Background expired-session sweep cadence.
lockoutThreshold	5	Consecutive failures (per username+IP) before lockout.
lockoutBaseMs	30000	First lockout duration.
lockoutMaxMs	900000 (15m)	Exponential-backoff cap.
lockoutWindowMs	900000 (15m)	Idle time after which the failure counter resets.
minPasswordLength	12	Minimum password length (floor 8).
secure	false	true behind TLS: sets Secure + __Host- cookie, forces Path=/.
sameSite	"Strict"	Cookie SameSite (Strict or Lax).
cookiePath	"/"	Cookie Path.
trustedOrigins	[]	Extra Origin values accepted on state-changing POSTs.
scrypt	{N:16384,r:8,p:1,keylen:64,maxmem:64MiB}	Password hashing cost.

Behind a TLS reverse proxy, set "secure": true so the session cookie gets Secure and the __Host- prefix. On plain loopback HTTP the cookie cannot be Secure (browsers would drop it).