granted07@kolkata:~/mc-console$ npm start

mc-console

A web page that shows a Minecraft server's log as it happens, and lets the right people type into it. The lines behind this text are made up, but they scroll the way the real ones do.

scroll

A Minecraft server is a program with a text window. To watch it, or talk to it, you have to be sitting at that window.

That normally means logging in to the machine it runs on. I wanted a link instead.

The server lives inside tmux, which can copy everything it prints into a file.

tmux pipe-pane -t minecraft -o 'cat >> ~/session.log'

Reading is the easy half. The page watches that file, and whenever it grows it sends only the new bytes to every open browser. Someone who arrives late gets the last 500 lines first, so they join mid-sentence rather than a blank screen.

log file → websocket → browser

Writing is the dangerous half.

now get a command through

Whatever is typed here goes into a live server. So it passes six checks, in order, before it gets anywhere near it. Try the wrong token. Send six in a row. Send nothing. Notice which check stops you, and which ones you never reach.

token
try
  1. ·tokendoes the Bearer token match?
  2. ·rate limit5 commands per 10 seconds
  3. ·not emptyafter trimming
  4. ·short enough256 characters at most
  5. ·plain textno control characters
  6. ·tmuxhand it to the server

session.log● running
[12:00:00] [Server thread/INFO]: Done (4.2s)! For help, type "help"

The checks and their order are the real ones. The server is not: nothing on this page is connected to a Minecraft server.

The last step is small on purpose. The command goes to tmux as a single argument. No shell, no string stitching.

spawn("tmux", ["send-keys", "-t", session, command, "Enter"]);

No SSH is exposed. The only thing this page can do to the server is press keys.

where to look

what it does not claim

!There is one shared token. Anyone who has it can do everything the console can.

!The live connection carries the token in its address, so this should only ever be served over HTTPS.

!Rate limits are counted per token and per address. The address comes from a proxy header, so that only holds behind a proxy you trust.