Ephemeral state and network security
dcmview is ephemeral, not automatically private. It keeps application state in memory and disappears when stopped, but anyone who can reach its unauthenticated HTTP server may be able to retrieve sensitive DICOM content.
What ephemeral means
Section titled “What ephemeral means”The viewer does not create a database, read a project configuration file, or save a reusable browser session. During one run it owns:
- the progressive file and logical-series registry;
- decoded display and raw-frame caches;
- tag-tree caches;
- request activity and server start time;
- the current in-memory ROI annotation store; and
- optional SSH helper process state.
Stopping the process releases these resources. Unexported annotation edits disappear.
dcmview reads source DICOM files and an optional annotation CSV but does not modify them. Choosing Export ROIs is an explicit persistence action: the browser downloads a newly generated CSV to its configured download location.
The server has no authentication
Section titled “The server has no authentication”The default --host 127.0.0.1 exposes the server only through the machine’s IPv4 loopback interface. This is the intended local and SSH-forwarded configuration.
Anyone who can reach the server may be able to access:
- decoded image pixels and rendered frames;
- patient, study, series, and instance metadata;
- local filesystem paths;
- locally resolved DICOM relationships;
- in-memory annotations; and
- build and scan information.
Binding --host 0.0.0.0 or another non-loopback interface broadens that exposure. The runtime warns about public binds, but it does not add authentication or authorization. Provide your own network controls if you deliberately change the host.
Remote access uses SSH forwarding
Section titled “Remote access uses SSH forwarding”Run dcmview beside the data, bind it to remote loopback, and forward that port to local loopback. The remote inspection guide gives the complete procedure.
The optional built-in SSH helper does not change the viewer’s authentication model; it only manages a forwarding process. A failed helper degrades gracefully and the local viewer can remain available.
Idle timeout is lifecycle control
Section titled “Idle timeout is lifecycle control”--timeout SECONDS stops the server after the specified interval without API or browser requests. It is useful for unattended scripts and remote sessions, but it is not an access-control mechanism: every request resets the activity clock.
Handle sensitive diagnostics carefully
Section titled “Handle sensitive diagnostics carefully”DICOM files, screenshots, exported CSVs, URLs, paths, tags, and logs can contain protected health information, research identifiers, hostnames, or institutional details. Use synthetic fixtures, redacted logs, and minimal reproduction steps in public issues. Report suspected vulnerabilities privately through the project’s security policy.