File Browser Next

Name: File Browser Next — Download free. Server file management
Availability: InStock
Rating: 5 (1 reviews)
Author: File Browser Next Contributors

File Browser Next — Free Download. Server file management

File Browser Next is a security-hardened continuation of the original File Browser project. It delivers a web-based file management interface for a specified directory on your server, enabling uploads, deletion, previewing, and editing of files. The platform includes server-side JWT revocation, brute force protection on authentication, reverse-proxy-aware client IP detection, and a command runner confined to the user directory.

★★★★★

5.0(1 ratings)

Download File Browser Next (Official links)

File size: 15.3 MB

The latest version of File Browser Next is: 3.0.0

Operating system: Windows, Mac OS, Linux

Languages: English, Spanish, Italian, Chinese, Portuguese, German, Russian, French

Developer: File Browser Next Contributors

Price: $0.00 USD (Open Source (Apache-2.0))

Server-Side Session Revocation. Logging out triggers a dedicated endpoint that instantly revokes the JSON Web Token server-side. A persistent BoltDB store tracks revoked tokens with in-memory caching for rapid lookups. This mechanism prevents continued access after a user terminates a session, addressing a critical gap in the original project where tokens remained valid until expiration.
Brute Force Login Protection. The authentication endpoint limits requests to ten attempts per IP address within a five-minute window. Exceeding this threshold returns an HTTP 429 response. The same rate limiting applies to password attempts on protected public shares, blocking automated guessing attacks against user credentials and shared links.
Reverse-Proxy IP Detection. Client IP addresses are resolved correctly when the application sits behind Cloudflare, Caddy, Nginx, or Pangolin. Proxy headers such as CF-Connecting-IP and X-Forwarded-For are trusted only when the direct TCP connection originates from a private or loopback address. Direct internet connections cannot forge these headers to bypass rate limiting.
Command Runner Confinement. Execution working directories are strictly confined within the user scope using canonical path checks. Dangerous shell metacharacters including semicolons, ampersands, pipes, backticks, dollar signs, newlines, and redirection operators are blocked for non-admin executions. Binaries execute directly without passing strings through an unconstrained shell interpreter.
Targeted Session Invalidation. User account changes such as password modifications, permission updates, username alterations, scope adjustments, or rule changes immediately invalidate active sessions through timestamp tracking. Cosmetic preference saves like language, theme, or view mode no longer disconnect the user, fixing a legacy bug that forced re-login after any settings change.
Single-Use Token Renewal. When an active session token is renewed, the previous token identifier is immediately revoked. This prevents replay attacks where an old token could be reused after a new one was issued, ensuring only the most recent authentication credential remains valid.
Hardened HTTP Security Headers. All responses include X-Frame-Options set to DENY to block clickjacking, X-Content-Type-Options set to nosniff to prevent MIME sniffing, and Referrer-Policy set to strict-origin-when-cross-origin. A Permissions-Policy header disables camera, microphone, and geolocation APIs that a file manager does not require.
Case-Insensitive Authentication. Username lookup at login operates without case sensitivity. Entering Admin or ADMIN correctly authenticates as the admin user. This matches expected behavior and eliminates a source of login failures in the original codebase.
Login Whitespace Sanitization. Leading and trailing whitespace on the login form is automatically removed before authentication. Users who accidentally include spaces when copying credentials no longer encounter failed login attempts due to invisible characters.
Strict Error Handling. Tokens referencing deleted users or invalid states return a 401 Unauthorized response instead of internal server errors. This clarifies authentication failures and prevents information leakage through error messages that could reveal system details.
Glassmorphic Interface Redesign. The visual layer uses blur backdrops on top navigation bars, action bars, modals, and file selection docks. A modern indigo and slate color palette with soft multi-layer box shadows and 8px, 12px, and 16px rounded borders replaces the older design.
Redesigned Login Page. The authentication screen features a card layout with ambient mesh gradients and responsive styling. Form controls received improved spacing and visual feedback for a more structured entry point to the file management interface.

File Browser Next began as a fork of the original File Browser project to address long-standing security architecture issues. The development focus centered on resolving documented problems with session revocation and command execution hardening. The codebase is written in Go, chosen for its compilation to single static binaries and strong standard library support for web servers. The fork emerged after the upstream project maintained features without implementing critical security fixes for token revocation and shell injection prevention.

Alternatives to File Browser Next:

XYplorer — Free Download. File Management

XYplorer

Deskora

DockDuck

Holdem