Doudou
d7b96ecd4d
Multi-user collaboration for the current ComfyUI frontend, continued from ComfyUI-Nexus by daxcay (MIT). - Login page before ComfyUI loads, first-run admin setup, JWT sessions - Personal API keys; server-side permission checks (edit, queue, manager, admin) - Every workflow shared as a live room, with snapshots and history - Per-workflow access lists (view / edit per person) - Conflict-free concurrent edits (id remapping, per-id link merges) - Presence: who is online, cursors, selections, follow mode - Chat with unread badge, blinking icon and sound - Server monitor (CPU, RAM, GPUs, queue) with a floating widget - Admin options to hide the Comfy.org login and API templates - Docs, changelog, screenshots and icon
43 lines
2.7 KiB
Markdown
43 lines
2.7 KiB
Markdown
# Security
|
|
|
|
What RigShare does to keep the rig yours, and what it leaves to you.
|
|
|
|
## Passwords
|
|
|
|
- Stored hashed (PBKDF2-SHA256, salted), never in plain text.
|
|
- At least 8 characters.
|
|
- Unknown usernames take as long to reject as wrong passwords, so accounts cannot be discovered by timing.
|
|
- Five failed logins from one address in a minute blocks that address for a minute.
|
|
- There are no default accounts. The first admin is created on first run, and only while no account exists.
|
|
|
|
## Sessions
|
|
|
|
- Signing in issues a **JWT** (HS256), signed with a 64-byte random key generated on first start (`secret.key`, file mode 600).
|
|
- Tokens live 12 hours and are silently renewed while in use. A login lasts at most 30 days.
|
|
- Each token names a server-side session. Logging out, changing a password or deleting an account ends access immediately, instead of whenever the token expires.
|
|
- Only HS256 is accepted, so `alg: none` and algorithm-swapping tokens are rejected. Signature, expiry, not-before and issuer are all checked.
|
|
- The token travels in an `HttpOnly`, `SameSite=Lax` cookie, `Secure` over HTTPS. Page scripts cannot read it, and other sites cannot make your browser use it for changes.
|
|
|
|
## API keys
|
|
|
|
- Random 256-bit keys, stored only as SHA-256 hashes and shown once when created.
|
|
- They carry their owner's permissions, can be revoked at any time, and record when they were last used.
|
|
|
|
## Permissions
|
|
|
|
- The server checks identity and permissions on every websocket message and API call; the UI only mirrors them. A modified browser cannot impersonate someone else or edit without *Edit*.
|
|
- ComfyUI's queue, interrupt, free and upload endpoints are checked server-side, and so are saving (Edit) and deleting (Admin) workflow files (`api_protection`).
|
|
- Without *Admin*, account and server settings are refused.
|
|
- Without *Manager*, ComfyUI Manager's API is refused and its button hidden. Only a few read-only lookups the frontend makes for everyone stay open.
|
|
- A restricted workflow is refused to anyone not on its list: joining it, reading it, its snapshots, and its file through ComfyUI's API.
|
|
|
|
## What is up to you
|
|
|
|
- **Use HTTPS.** Over plain HTTP, the login and cookie cross the network in the clear. See [Reverse proxy](reverse-proxy.md).
|
|
- **Finish setup right away.** Until the first admin exists, anyone who reaches the page can create it.
|
|
- **Keep trusted IPs short.** They skip every check.
|
|
- **Custom nodes run code on the server.** RigShare controls who uses ComfyUI, but anyone who can queue can run whatever nodes are installed. Give *Queue* to people you trust.
|
|
- **Protect the data folder.** `secret.key` signs sessions and `users.json` holds the hashes.
|
|
|
|
Found a problem? Please open an issue, or for anything sensitive contact the maintainer privately first.
|