Download File Browser Next
File Browser Next provides a server-side file management interface with revocation of authentication tokens at logout. It includes rate limiting on login attempts and confines command execution to a designated directory. The application resolves client IP addresses behind reverse proxies and applies strict HTTP security headers to responses.
The platform replaces the original File Browser with a hardened authentication model where sessions terminate immediately upon user action. Non-admin command execution blocks shell metacharacters and executes binaries directly. Preference changes no longer invalidate active sessions, while credential modifications revoke all existing tokens for that account.
File Browser Next targets server administrators who require a web-based file manager with enforcement of security boundaries. The interface uses a glassmorphic design with a redesigned login page. Token renewal revokes previous identifiers to prevent replay, and error handling returns 401 for deleted user references.
| Server-side JWT revocation stored in BoltDB with caching | Logout instantly terminates session before token expiration |
| Ten attempts per IP within five-minute window | HTTP 429 blocks credential and share-link guessing |
| Proxy headers trusted only from private or loopback peers | Direct connections cannot forge CF-Connecting-IP or X-Forwarded-For |
| Canonical path checks confine execution working directories | Shell metacharacters blocked for non-admin command runs |
| Account changes invalidate sessions via timestamp tracking | Preference saves no longer disconnect active users |
| Previous token identifier revoked during renewal | Replay attacks using old credentials prevented |
| X-Frame-Options DENY and nosniff on all responses | Permissions-Policy disables camera, microphone, geolocation APIs |
| Username lookup operates without case sensitivity | Admin and ADMIN authenticate identically |
| Leading and trailing login whitespace removed before authentication | Copied credentials with spaces no longer fail |
| Tokens referencing deleted users return 401 Unauthorized | Prevents internal error leakage revealing system details |
| Blur backdrops on navigation, modals, and selection docks | Indigo and slate palette with multi-layer shadows |
| Card layout login with ambient mesh gradients | Responsive form controls with improved visual feedback |