Security

API Authentication

Nginjen supports API key authentication to protect the HTTP API.

Enable Auth

[api]
api_key = "your-secret-key"

Public vs Protected

Category	Endpoints	Auth Required
Public	/health, /openapi.json, /ws	No
Protected	All others	Yes

When api_key is set, protected endpoints require:

Authorization: Bearer your-secret-key

Disable Auth

Leave api_key unset (or empty) to disable authentication. This is the default, suitable for local development or when Nginjen sits behind a firewall/auth proxy.

Network Binding

By default, Nginjen binds to 127.0.0.1 (localhost only). To expose externally:

[server]
host = "0.0.0.0"

WARNING

Binding to 0.0.0.0 without API authentication is dangerous. Always set api_key when exposing to the network.

Chromium Sandbox

Nginjen runs Chromium with --no-sandbox by default for compatibility with container environments. In production:

• Run as a non-root user
• Use container isolation (Docker, systemd namespace)
• Consider enabling the sandbox if your environment supports it

Secrets in Config

The config file may contain sensitive values (api_key, proxy credentials). Protect it:

chmod 600 ~/.config/nginjen/config.toml
chown $USER:$USER ~/.config/nginjen/config.toml

For systemd deployments, store the config in /etc/nginjen/ with restricted permissions.

Legal Notice

Nginjen is a browser automation tool for developers, testers, and researchers. Use only for lawful purposes. You are responsible for complying with target websites' Terms of Service and applicable laws (CFAA, GDPR, UU ITE).

See the full Terms of Use.