search

hjyssg / ShiguReader

硬核宅宅资源管理器. Ultimate Manga Resource Manager
MIT License
397 stars 45 forks source link

ShiguReader is only for LAN #108

Closed hjyssg closed 2 years ago

hjyssg commented 3 years ago

First, the server is only safe at home LAN environment. The express server provides API that users can list/download/move/delete files. Currently, server don't do any security check, just do what the request asks. However, if exposing ShiguReader to public web, malicious hacker can easily destroy your computer. e.g. They can list all you zip files and delete them all.

If any dev who want to improve security, they need to refactor server code a lot. e.g. Creating a user login system, only authorized user can do certain file operation. That will be a huge workload to implement. My estimation is that, 8 hours per day, at least one month for coding and testing.

Second, if you run ShiguReader on your home pc and want to access it when going outside. You have to make its IP publicly accessible. Google how to do and you will find out it is troublesome and costs money. If you run ShiguReader on cloud server, you don't have to worry about IP. But you still must pay a monthly fee for cloud server.

Third, the server sends uncompressed image to the client. Sometimes, each image can be >20MB. 20MB image is totally okay in LAN. But it will be too slow to load in public web.

In conclusion, accessing Shigureader from public web is a bad idea. It requires a huge workload to implement security. And It still costs money. DropBox or Google Drive will be cheaper and more reliable. Setting up a WordPress website is also a good choice.

hjyssg commented 2 years ago

Added login and token checking. Should be safe somehow.