webdrop

Share any directory over HTTP and FTP from the command line. Point it at a folder, and both a web file browser and an FTP server come up instantly.

Features

• Serves a directory as a browsable web page (with file listing, sizes, and download links)
• Serves the same directory over FTP
• Runs both servers at once, or either one on its own
• Optional username/password auth on both HTTP (Basic Auth) and FTP
• Path-traversal safe: requests cannot escape the shared root
• Zero config — just point it at a folder

Requirements

• Node.js 14 or later

Installation

Global (CLI usage)

npm install -g webdrop

Local (as a dependency)

npm install webdrop

From source

git clone <repo-url>
cd webdrop
npm install

Usage

webdrop [options] [dir]

If dir is omitted, the current working directory is shared.

webdrop                      # share current dir: web :8080, ftp :2121
webdrop ~/Downloads          # share a specific directory
webdrop ./photos --web-port 3000
webdrop ./docs --ftp-only    # FTP only, no web server
webdrop ./files --user alice --pass hunter2   # require login
webdrop ./files --user alice                  # prompts for password

Then open http://localhost:8080 in a browser, or connect to ftp://localhost:2121 with any FTP client (anonymous login by default).

Options

| Option | Description | Default | | --------------- | ---------------------------------------- | ------- | | dir | Directory to share | . | | --web-port <n>| HTTP port | 8080 | | --ftp-port <n>| FTP port | 2121 | | --host <ip> | Interface to bind | 0.0.0.0 | | --web-only | Disable the FTP server | — | | --ftp-only | Disable the HTTP server | — | | --user <name> | Require this username on both servers | — | | --pass <pass> | Password for the user (prompted if omitted) | — | | -h, --help | Show help | — | | -v, --version | Show version | — |

Programmatic API

const { startWebServer, startFtpServer } = require('webdrop');

const web = await startWebServer('/path/to/dir', 8080, '0.0.0.0');
const ftp = await startFtpServer('/path/to/dir', 2121, '0.0.0.0');

// with authentication:
const auth = { username: 'alice', password: 'hunter2' };
const secured = await startWebServer('/path/to/dir', 8080, '0.0.0.0', auth);

// later
web.close();
ftp.close();

Both functions accept an optional auth argument ({ username, password }). When provided, HTTP uses Basic Auth and FTP rejects any login that does not match. Both return a Promise that resolves to { host, port, close }.

Security notes

• The web server resolves every request against the shared root and rejects anything that escapes it.
• FTP login is anonymous by default. Do not expose it to the public internet without adding authentication (--user/--pass) or a firewall.
• HTTP Basic Auth sends credentials base64-encoded (not encrypted). Use --pass only over trusted networks, or pair with TLS/a reverse proxy.
• ftp-srv depends on legacy glob/rimraf/uuid code. package.json pins overrides to the patched ip@2 and uuid@11; npm audit may still report a stale high-severity finding for ip (advisory DB lists ip *, though 2.0.1 ships the fix). Use at your own risk in untrusted environments.

License

MIT