Skip to Content
ReferenceSecurity

Security

Network Model

PiEEG Server is designed for local network use — your Raspberry Pi streams EEG data to devices on the same WiFi/LAN.

EEG data is sensitive biometric information. Do not expose ports 1616/1617 to the public internet without additional security layers.

Built-in Protections

LayerProtection
AuthenticationOptional 6-digit code with --auth
Rate limitingBrute-force protection on auth endpoint
HMAC timing-safePrevents timing-based code guessing
HttpOnly cookiesSession tokens not accessible to XSS
Per-restart codesFresh access code on every server start
Webhook cooldownsServer-enforced rate limiting on HTTP callbacks

Recommendations

  • Enable --auth on shared networks
  • Use a VPN or SSH tunnel for remote access
  • Keep the server updated (pieeg-server self-update from dashboard)
  • Review webhook URLs — they relay data to external services
  • For production/research use, consider a reverse proxy (nginx/caddy) with TLS
AuthenticationTroubleshooting