Getting Started with Photo Supreme's Integrated HTTP Server

Configure the PSO Pages

Find or create the file

Edit config.json in the actual Root Folder configured above. In this source checkout, the supplied client pages are located at:

C:\CodeBase\deploy\Resources\WebServerPSO

An installed copy normally uses its own Resources\WebServerPSO folder instead. Editing the source checkout will not change an installed server that serves a different folder.

The installation process creates config.json from config.default.json if the configuration file does not already exist. If it is missing, you can copy config.default.json in the same folder and rename the copy to config.json. Do not replace an existing customized configuration with the default file. Keep a backup before editing or upgrading.

Understand the two API addresses

For a normal single-server setup, set both fields to the same address. Split addresses are an advanced arrangement: both destinations must serve the appropriate authenticated API/media requests for the same catalog and users. Do not point thumbsUrl at a public file share or an arbitrary image host.

These addresses are used by the visitor's browser. localhost and 127.0.0.1 mean the visitor's own computer, not the Photo Supreme server.

Enter the base address without a trailing slash and without /api, /auth, /index.htm, or a local filesystem path. The client adds endpoint paths itself. Keep the existing clientid, scope, and other settings unless a documented deployment requirement calls for a change. clientid is a public client identifier, not a password.

Example: local-network connection

For an initial, controlled LAN test against 192.168.1.50:

{
  "api": {
    "url": "http://192.168.1.50:12543",
    "clientid": "728621F0D1D34F9F9106507A91FBCEFC",
    "scope": "",
    "thumbsUrl": "http://192.168.1.50:12543"
  }
}

This is an excerpt showing the api block; preserve the rest of your existing file. Open http://192.168.1.50:12543/index.htm on the other computer.

Plain HTTP does not encrypt passwords, session tokens, or images. Use it only for a deliberately limited setup check, not as the recommended ongoing setup. For direct HTTPS, change both addresses and the browser URL to the matching trusted HTTPS hostname and port.

Example: recommended HTTPS reverse-proxy connection

If users open https://photos.example.com, use:

{
  "api": {
    "url": "https://photos.example.com",
    "clientid": "728621F0D1D34F9F9106507A91FBCEFC",
    "scope": "",
    "thumbsUrl": "https://photos.example.com"
  }
}

The browser must not be given the proxy's private upstream address, such as http://127.0.0.1:12543. That address belongs in the reverse-proxy configuration, not in the public client configuration.

The current supplied client also supports empty strings for both API addresses to use the page's own origin. Explicit addresses are shown here to make the network arrangement clear. The shipped default file's localhost values are not suitable for visitors on other computers.

Use valid JSON: double quotes, no comments, and no trailing commas. Ensure the filename is config.json, not config.json.txt. Never put passwords, private keys, database credentials, or session tokens in this browser-readable file. Reload the page after editing, and check the served /config.json in browser developer tools if the application appears to use the old values.