Photo Supreme Manuals
All manuals

Photo Supreme documentation

Search all manuals

Enter at least two characters.
    Manual contents
    1. Introduction
    2. Choose Who Should Be Able to Connect
    3. Prepare the Computer and Catalog
    4. Configure and Start the Embedded Server
    5. Configure the PSO Pages
    6. Router and Host-Firewall Rules
    7. Use an HTTPS Reverse Proxy
    8. Browser Origins and CORS
    9. Security and Privacy Checks
    10. Verify the Setup
    11. Troubleshooting

    Getting Started with Photo Supreme's Integrated HTTP Server

    Security and Privacy Checks

    • Accounts: Avoid shared administrator logins. Remove unused accounts, apply least privilege, and use multi-factor authentication where your deployment supports it. Verify the available sign-in options rather than assuming a particular desktop build supplies every authentication feature. See the OWASP authentication guidance.
    • Downloaded originals and metadata: Images can contain GPS coordinates, personal names, capture dates, and other private information. Review download permissions and formats. The supplied download examples retain metadata, including GPS, unless you change those settings. A hidden download button is not a substitute for server-side authorization.
    • Shared links: Published collections and direct-image links intentionally make selected content accessible. Treat their URLs as sensitive access links, review what is shared, and revoke links when access is no longer intended. Do not assume a login screen elsewhere makes every shared link private.
    • Logs and tokens: Restrict access to both proxy and application logs. Media URLs can carry tokens in their query strings; avoid recording complete sensitive URLs and redact tokens before sharing logs, browser traces, or screenshots.
    • Files and process privileges: Keep certificates, private keys, backups, database files, and exported logs outside every web root. Limit who can alter the PSO HTML/JavaScript: modified client files can compromise users signing in. Do not run the proxy or application with unnecessary OS privileges.
    • Public exposure: Add sensible edge request/connection limits and login-abuse protection. Do not assume the embedded application implements every production edge defense. Restrict proxy administration interfaces to trusted administrators.
    • Headers and caches: Consider suitable referrer, framing, content-type, and content-security policies at the proxy, but test the application before enforcing them. Enable HSTS only after trusted HTTPS works reliably; do not casually add includeSubDomains or preload settings affecting other sites.
    • Operations: Monitor certificate expiry, failed sign-ins, unusual downloads, disk space, and log growth. Keep independent backups, document who maintains the server, and test updates and recovery. Stop the HTTP server when it is not needed. A reverse proxy does not fix vulnerabilities in an unpatched backend.