Put the terminal behind the right account
A web terminal needs a server connection, an authenticated user and an explicit target. We connect the browser interface to a session service that checks permission before opening the shell. Tenant, project and environment boundaries belong in that service.
The design records session creation, expiry and termination. Logging out, removing access and closing a browser each have a defined effect on the server process.
Plan output, input and interruption handling
A terminal stream carries control characters, changing screen dimensions and potentially large output. We test full screen tools, Unicode, rapid output and the behaviour of mobile keyboards. Input queues and reconnect handling must avoid repeating a destructive command.
WebSocket authorization, secure transport and page scripts need attention throughout the build. The xterm.js security guide identifies risks from terminal access, untrusted output and scripts sharing the same page.
Embed the controls your product needs
A hosting portal may need a shell scoped to a single account. A support console may allow read access first, followed by a separately approved command. A training environment can create short lived sandboxes. Those are different products with different permissions.
| Boundary | Define it before development |
|---|---|
| User | Who can start, read and terminate a session |
| Target | Which account, container or host receives input |
| Data | What output is retained and who can retrieve it |
| Lifecycle | What happens on disconnect, timeout and logout |
Test the route from sign in to sign out
The delivery includes the integration contract, session states, browser support matrix and operator recovery instructions. We test expired authorization, rejected origins, large output and a terminated process alongside ordinary shell use.
Before you begin
Can a terminal be added to our customer portal?
Yes. The server account and resource boundary must be defined for each customer. We test access between customers as part of the integration.
Does the browser terminal need a public SSH port?
The network design determines that. A gateway or internal agent may reach the target privately. We confirm the reachable routes and firewall policy before implementation.
DSDillon / 26 September 2026
