customable/claude-mem

Fork 0

Web viewer authentication for network exposure #7

New issue

Closed

opened 2026-01-21 20:45:26 +00:00 by jack · 3 comments

jack commented

2026-01-21 20:45:26 +00:00

Owner

Problem

With CLAUDE_MEM_WORKER_HOST=0.0.0.0, the Web Viewer is accessible to everyone on the network without authentication.

Exposed data:

Session observations
User prompts
Project structure
Activity timeline

Solution: Token-based Auth

{
  "CLAUDE_MEM_WORKER_HOST": "0.0.0.0",
  "CLAUDE_MEM_AUTH_ENABLED": "true",
  "CLAUDE_MEM_AUTH_TOKEN": "auto"
}

auto generates a random token on first start
Token as query param or Authorization header
Cookie-based session after first auth

Implementation

Middleware for token validation
Settings page for token management
CLI command to show/regenerate token

Migrated-From: jack/claude-mem-fork#74

## Problem With `CLAUDE_MEM_WORKER_HOST=0.0.0.0`, the Web Viewer is accessible to everyone on the network without authentication. Exposed data: - Session observations - User prompts - Project structure - Activity timeline ## Solution: Token-based Auth ```json { "CLAUDE_MEM_WORKER_HOST": "0.0.0.0", "CLAUDE_MEM_AUTH_ENABLED": "true", "CLAUDE_MEM_AUTH_TOKEN": "auto" } ``` - `auto` generates a random token on first start - Token as query param or Authorization header - Cookie-based session after first auth ## Implementation - Middleware for token validation - Settings page for token management - CLI command to show/regenerate token -------- Migrated-From: jack/claude-mem-fork#74

jack

2026-01-22 17:53:47 +00:00

closed this issue
added the
priority
high

type
feature
labels

jack commented

2026-01-22 18:08:50 +00:00

Author

Owner

This feature has been fully implemented in src/services/server/middleware/auth.ts:

✅ Token-based authentication via Bearer header
✅ Localhost bypass (127.0.0.1, ::1 always allowed)
✅ CLAUDE_MEM_REMOTE_TOKEN setting for token configuration
✅ Automatic middleware activation when binding to non-localhost
✅ Scope-based authorization with requireScope() middleware
✅ Rate limiting for remote connections

Configuration:

{
  "CLAUDE_MEM_WORKER_HOST": "0.0.0.0",
  "CLAUDE_MEM_REMOTE_TOKEN": "your-secret-token"
}

This feature has been fully implemented in `src/services/server/middleware/auth.ts`: - ✅ Token-based authentication via Bearer header - ✅ Localhost bypass (127.0.0.1, ::1 always allowed) - ✅ `CLAUDE_MEM_REMOTE_TOKEN` setting for token configuration - ✅ Automatic middleware activation when binding to non-localhost - ✅ Scope-based authorization with `requireScope()` middleware - ✅ Rate limiting for remote connections Configuration: ```json { "CLAUDE_MEM_WORKER_HOST": "0.0.0.0", "CLAUDE_MEM_REMOTE_TOKEN": "your-secret-token" } ```

jack reopened this issue

2026-01-22 18:09:22 +00:00

jack commented

2026-01-22 18:09:23 +00:00

Author

Owner

Reopening - API token auth is implemented but Web UI needs:

Login page for entering token
Cookie-based session after successful auth
Redirect to login when accessing viewer without session

The current Bearer token approach works for API clients but not for browser access.

Reopening - API token auth is implemented but Web UI needs: - [ ] Login page for entering token - [ ] Cookie-based session after successful auth - [ ] Redirect to login when accessing viewer without session The current Bearer token approach works for API clients but not for browser access.

jack commented

2026-01-22 18:15:40 +00:00

Author

Owner

Implementation Complete

The web viewer now has proper user-friendly authentication with a login page:

Features Added:

Login Page (/login)
- Clean, styled login form with token input
- Automatic redirect to viewer on success
- Error messages for invalid tokens
- Redirects to / when auth is not required (localhost mode)
Cookie-based Sessions
- 24-hour session duration
- HttpOnly, secure cookies
- Automatic session cleanup (hourly)
- Session invalidation on logout
Auth Routes
- GET /login - Login page HTML
- POST /api/auth/login - Authenticate with token
- POST /api/auth/logout - Clear session
- GET /api/auth/status - Check auth status
Logout Button in UI
- Only appears when remote auth is configured
- Located in the topbar actions area
- Clears session and redirects to login

How it works:

Localhost access: No authentication required, full access granted
Remote access (when CLAUDE_MEM_REMOTE_TOKEN is configured):
- Unauthenticated browser requests to / redirect to /login
- User enters the configured token
- On success, a session cookie is set and user is redirected to the viewer
- API requests can still use Bearer token authentication

Files Changed:

src/services/server/middleware/auth.ts - Session management functions
src/services/worker/http/middleware.ts - Added cookie-parser
src/services/worker/http/routes/AuthRoutes.ts - New auth routes
src/services/worker-service.ts - Register auth routes
src/ui/viewer/layouts/Topbar/TopbarActions.tsx - Logout button

## Implementation Complete The web viewer now has proper user-friendly authentication with a login page: ### Features Added: 1. **Login Page (`/login`)** - Clean, styled login form with token input - Automatic redirect to viewer on success - Error messages for invalid tokens - Redirects to `/` when auth is not required (localhost mode) 2. **Cookie-based Sessions** - 24-hour session duration - HttpOnly, secure cookies - Automatic session cleanup (hourly) - Session invalidation on logout 3. **Auth Routes** - `GET /login` - Login page HTML - `POST /api/auth/login` - Authenticate with token - `POST /api/auth/logout` - Clear session - `GET /api/auth/status` - Check auth status 4. **Logout Button in UI** - Only appears when remote auth is configured - Located in the topbar actions area - Clears session and redirects to login ### How it works: - **Localhost access**: No authentication required, full access granted - **Remote access (when `CLAUDE_MEM_REMOTE_TOKEN` is configured)**: - Unauthenticated browser requests to `/` redirect to `/login` - User enters the configured token - On success, a session cookie is set and user is redirected to the viewer - API requests can still use Bearer token authentication ### Files Changed: - `src/services/server/middleware/auth.ts` - Session management functions - `src/services/worker/http/middleware.ts` - Added cookie-parser - `src/services/worker/http/routes/AuthRoutes.ts` - New auth routes - `src/services/worker-service.ts` - Register auth routes - `src/ui/viewer/layouts/Topbar/TopbarActions.tsx` - Logout button

jack closed this issue

2026-01-22 18:15:45 +00:00