Authentication

Default behaviour

Setting a password

# Command-line flag
tessera-web --password mysecretpassword ~/Photos

# Environment variable (useful in scripts and containers)
TESSERA_PASSWORD=mysecretpassword tessera-web ~/Photos

# Read password from a file (takes precedence over --password and env)
tessera-web --password-file /run/secrets/tessera ~/Photos

# Generate a random password and print it to stderr
tessera-web -P ~/Photos

Disabling authentication

If tessera-web is running behind a reverse proxy that handles authentication (e.g. Caddy, nginx, Authelia), you can disable the built-in auth:

tessera-web --no-auth --bind 0.0.0.0 ~/Photos

Session management

Successful login sets an HttpOnly, SameSite=Strict cookie (ft_session) that lasts 24 hours. To log out, click the Log out button in the top-right corner or navigate to /logout.

Security notes

• The Secure cookie flag is not set — tessera-web does not manage TLS. If you expose the server over the internet, place it behind a TLS-terminating reverse proxy.
• Passwords are stored as SHA-256 hashes in memory only; they are never written to disk.
• There is no rate limiting on the login endpoint; use a reverse proxy or firewall rules to limit access from untrusted networks.