Allow live browser without a configured password

README.md

@@ -14,9 +14,8 @@ An interactive remote Chromium browser streamed through noVNC.
 
 ## Use
 
-1. In **Settings → Variables and secrets**, create `BROWSER_PASSWORD` with at least 8 characters. `VNC_PASSWORD` is also accepted as an alias.
-2. Open the Space and click **Open live browser**.
-3. Enter the first 8 characters of the password when noVNC asks.
-4. Use the visible Chromium address bar to search, type, click, scroll, and navigate.
+1. Open the Space and click **Open live browser**.
+2. Use the visible Chromium address bar to search, type, click, scroll, and navigate.
+3. Optional: add `BROWSER_PASSWORD` or `VNC_PASSWORD` in **Settings → Variables and secrets** to protect the VNC connection. Without a password, anyone with this public URL can control the browser.
 
 The browser starts on DuckDuckGo. This Space is public, so do not enter sensitive credentials or private information. Use it only for websites you are authorized to access.

browser-ui/index.html

@@ -47,7 +47,7 @@
         <div class="step"><strong>3 · Browse</strong><span>Search and use the browser normally.</span></div>
       </div>
       <a class="launch" href="/vnc.html?autoconnect=true&resize=scale">Open live browser →</a>
-      <p class="note">The browser starts on DuckDuckGo. VNC authentication protects this public Space; use the first 8 characters of your <code>BROWSER_PASSWORD</code> Space secret.</p>
+      <p class="note">The browser starts on DuckDuckGo. No password is required in the current configuration, so anyone with this public URL may control the session. Add <code>BROWSER_PASSWORD</code> later if you want to turn protection on.</p>
     </section>
     <footer>Only browse websites you are authorized to access. Do not enter banking, email, or other sensitive credentials into a shared remote browser.</footer>
   </main>

start-browser.sh

@@ -1,24 +1,25 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-# Accept the recommended name plus the common VNC_PASSWORD alias.
+# Password protection is optional. If no secret is configured, the live browser
+# will be public to anyone who can open this Space URL.
 PASSWORD="${BROWSER_PASSWORD:-${VNC_PASSWORD:-}}"
-if [ -z "$PASSWORD" ]; then
-  echo "Set BROWSER_PASSWORD (or VNC_PASSWORD) in Space Settings → Variables and secrets." >&2
-  exit 1
-fi
-if [ "${#PASSWORD}" -lt 8 ]; then
-  echo "The browser password must contain at least 8 characters. x11vnc uses the first 8 characters." >&2
-  exit 1
+if [ -n "$PASSWORD" ]; then
+  if [ "${#PASSWORD}" -lt 8 ]; then
+    echo "The browser password must contain at least 8 characters. x11vnc uses the first 8 characters." >&2
+    exit 1
+  fi
+  x11vnc -storepasswd "${PASSWORD:0:8}" /tmp/vnc.pass >/dev/null
+  AUTH_ARGS=(-rfbauth /tmp/vnc.pass)
+else
+  echo "WARNING: no browser password configured; the public Space can control this browser." >&2
+  AUTH_ARGS=(-nopw)
 fi
 
 export DISPLAY=:99
 export HOME=/tmp/browser-home
 mkdir -p "$HOME" /tmp/browser-profile
 
-# VNC authentication is required because this Space is publicly reachable.
-x11vnc -storepasswd "${PASSWORD:0:8}" /tmp/vnc.pass >/dev/null
-
 Xvfb :99 -screen 0 1440x900x24 -ac +extension GLX +render -noreset >/tmp/xvfb.log 2>&1 &
 fluxbox -display :99 >/tmp/fluxbox.log 2>&1 &
 sleep 1
@@ -29,7 +30,7 @@ x11vnc \
   -shared \
   -localhost \
   -rfbport 5900 \
-  -rfbauth /tmp/vnc.pass \
+  "${AUTH_ARGS[@]}" \
   -noxdamage \
   -repeat >/tmp/x11vnc.log 2>&1 &