Access protection and deployment boundaries | Mingcedar Share

<div class="manual-doc-article manual-doc-article-section"><h2 id="hardening">Security: Access protection and deployment boundaries</h2>

Before deployment, confirm the shared folder, allowed network sources, account permissions, and backup plan.

<div class="doc-card-list">

<article class="doc-card">

<h3 id="hardening-item-1">Runtime log retention</h3>

<p>Login, preview, and file actions produce logs in the desktop app or headless output, which systemd journal can collect. Retention depends on deployment settings; there is no separate persistent or tamper-evident audit store.</p>

</article>

<article class="doc-card">

<h3 id="hardening-item-2">Shared-folder boundary</h3>

<p>The server resolves requested paths and rejects access outside the shared root. Sensitive files placed inside that root are still shared; choose a dedicated folder.</p>

</article>

<article class="doc-card">

<h3 id="hardening-item-3">Filename checks</h3>

<p>Upload, create, rename, and download requests extract the base name, replace special characters, and reject an empty result. Windows also rejects reserved device names. Sanitization can change the name; check the resulting file.</p>

</article>

<article class="doc-card doc-card-tip">

<h3 id="hardening-item-4">Upload size and disk space</h3>

<p>The default limit is 512 MiB per upload request, including all selected files and multipart overhead. Set a positive integer in maxUploadMb to change it. This limit is not a disk quota; check available disk space before uploading.</p>

</article>

<article class="doc-card">

<h3 id="hardening-item-5">Large-file transfer</h3>

<p>Downloads stream at speeds limited by the network, disk, and client. Interrupted downloads must restart; resume is unsupported.</p>

</article>

<article class="doc-card doc-card-warn">

<h3 id="hardening-item-6">Accounts and sessions</h3>

<p>Passwords use salted hashes; cookies use HttpOnly and SameSite=Lax. Sessions expire 12 hours after login by default. Desktop password changes do not revoke sessions; stop and restart sharing to clear them. HTTP has no transport encryption; deploy on a controlled LAN or VPN.</p>

</article>

<article class="doc-card">

<h3 id="hardening-item-7">Deployment checklist</h3>

<p>Use a dedicated shared folder, keep access on the LAN, fix the port, remove unused accounts, restrict delete permission, clean temporary files, and follow the latest downloads page for package access.</p>

</article>

</div></div>