Security

Pairing-first by default. The only thing standing between the internet and your host is a code that only ever exists on the server's console.

Authentication modes

In every protected mode the client presents a token as a query parameter on the WebSocket URL; a missing or wrong token rejects the upgrade with HTTP 401.

ws://host:1421/?token=<value>
wss://host:1421/?token=<value>
ModeHow to startClient behavior
Pairing (default) no flags Server prints a fresh XXXX-XXXX code + QR at startup. Ephemeral — valid until the server exits, never stored, rotated on restart.
Fixed token --token <value> or NOIDE_TOKEN Use that value as the token. Survives restarts (it is your secret).
No auth --no-auth Accepts unauthenticated connections and prints a loud warning. For localhost development / CI only.

Guidelines

  • Pairing is on by default. Anyone who can reach the port still needs the code that is only printed on the server's console.
  • Use wss:// outside a trusted LAN. The token travels in the URL query string, which intermediaries can log — never reuse a long-lived credential here.
  • --no-auth is for development. Anyone who can reach the port can read, write, and delete files and run shells on the host.
  • Constant-time comparison. The token is compared in constant time on the server.
  • Real certificates only. Browsers and mobile WebViews refuse untrusted wss:// endpoints — use Caddy / Let's Encrypt / a tunnel provider.

Tunneling & TLS

noide-server speaks plain WebSocket. Put a TLS-terminating reverse proxy in front of it and connect with wss://:

Caddy (recommended)

Automatic Let's Encrypt certificates. WebSocket upgrades handled automatically.

noide.example.com {
    reverse_proxy 127.0.0.1:1421
}

nginx

Terminate TLS and pass the upgrade through.

location / {
    proxy_pass http://127.0.0.1:1421;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 3600s;
}

No public IP / CG-NAT

Use an outbound tunnel — port forwarding when inbound isn't possible.

# Cloudflare Tunnel (free, trusted cert)
cloudflared tunnel --url http://127.0.0.1:1421
Avoid self-signed certificates: browsers and mobile WebViews refuse wss:// endpoints they don't trust, and there is no practical way to install your CA on a tablet.