Security

Encryption at rest (client-side)

Files are encrypted in the browser with AES-GCM-256 via the Web Crypto API before upload. The key is derived with PBKDF2 over a configurable iteration count, metadata travels in X-Mu-Encryption-* headers, and a decryptFile helper reverses it. Useful when you do not trust the transport or storage tier.

Companion broker

The self-hosted Node OAuth broker keeps provider client secrets and access tokens server-side. The browser holds only a signed, HttpOnly session cookie, and the OAuth state is HMAC-signed for CSRF protection. The in-browser pickers use implicit OAuth (token in client JS) - the broker is the hardened option.

Server-side signers

Direct-to-S3, Azure, and GCS uploads are signed by your server. The browser receives a short-lived signed URL - never your cloud account keys.

Virus scanning

A pluggable virusScan hook plus a dedicated /scan endpoint enable asynchronous post-upload scanning with quarantine semantics.

CSRF protection

A per-request headers callback lets you attach CSRF or anti-forgery tokens to every transfer so your backend can reject forged requests.

Content validation

MIME magic-byte sniffing validates the real content type rather than the extension, alongside extension, size, image-dimension, and aspect-ratio checks - all re-enforceable server-side through the /validate endpoint.

Access control

A per-request headers callback lets you attach auth tokens, and your backend stays the source of truth for who may upload.

Transport hardening

HTTPS is required for the encryption, service-worker, and cross-tab features - Web Crypto and service workers need a secure context. Cross-tab coordination uses a lock so the same file is never double-uploaded.

Enable client-side encryption

uploader.configure({
  encryption: {
    enabled: true,
    passphrase: userSecret,
    pbkdf2Iterations: 250000
  }
});

Mount the Companion broker

const broker = require("companion-broker");
app.use("/companion", broker({
  providers: ["dropbox", "box", "drive", "onedrive"],
  sessionSecret: process.env.SESSION_SECRET
}));