diff options
| author | tv <tv@krebsco.de> | 2026-11-08 14:13:05 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 15:26:03 +0100 |
| commit | 69a08327d24d08ba7a4e879116eeff60ac2a3874 (patch) | |
| tree | ca822e7efe7123c290fd7923034cd5123fe5584a /docs/access.md | |
| parent | 5de2994c6d8f5f266d60b4febdf9252a035488ad (diff) | |
dashboard: hand over a token reading the member list only
Review finding 8, second part: opening another member's dashboard
handed it a token reading everything (READ_ALL). A member writes its
own dashboard URL, so a malicious one received a read-everything token
under the operator's identity: /admin/config, /admin/changes,
/admin/log and the rest, on every node the user reaches.
The token handed over now reads the member list only (READ_MEMBERS, as
sent to subscribed nodes), which is enough to draw the map; the user
logs in at the other dashboard to see more. With 1151 it lasts five
minutes and isn't refreshed past them.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index a3b8864..107de8d 100644 --- a/docs/access.md +++ b/docs/access.md @@ -102,7 +102,7 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store then the user logs in again. A refreshed token may say less (`limit`), never more, and live less (`lifetime`, in seconds), and then ends its session with it: nobody refreshes it past its end. A dashboard opening another member's hands it one reading - only, for five minutes ([`dashboard.md`](dashboard.md)). + the member list only, for five minutes ([`dashboard.md`](dashboard.md)). * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued |