From 260802195b0158c44eb9d1a4f5f04c06a261ae65 Mon Sep 17 00:00:00 2001 From: Mikael Finstad Date: Sun, 2 Aug 2026 21:36:24 +0200 Subject: [PATCH] add doc about hardening --- docs/api.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/api.md b/docs/api.md index eaeb301c..086da9e9 100644 --- a/docs/api.md +++ b/docs/api.md @@ -12,6 +12,12 @@ To enable the API, run LosslessCut from the command line with this flag: LosslessCut --http-api ``` +## Security + +The server listens on `127.0.0.1` only, so it cannot be reached from other computers. It has no authentication, so any program running on your computer can control LosslessCut while the API is enabled. + +Requests coming from a web browser are rejected with `403`, because a web page you visit must not be able to control LosslessCut. This means requests must have a `Host` header of `localhost`/`127.0.0.1` (this prevents [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding)) and must not have an `Origin` header (which browsers always send, but command line tools don't). + ## Action endpoint: `POST /api/action/:action` Execute a keyboard shortcut `action`, similar to the `--keyboard-action` CLI option. This is different from the CLI in that most of the actions (but not all) will wait for the action to finish before responding to the HTTP request.