diff options
| author | tv <tv@krebsco.de> | 2026-11-08 14:15:26 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 15:32:02 +0100 |
| commit | fac4b143587188d283578bc51e13ca44bcfc6382 (patch) | |
| tree | 9ddaef363ca7e936c26744e218b12302b41709e5 /docs/access.md | |
| parent | 075ee0be09be7ebce846043e5230ffb67a7f9a5c (diff) | |
token: a banned node's tokens aren't taken
Review finding 11: token::verify checked only that the issuer is a
member, and a ban leaves the member entry. A compromised node's tokens
stayed valid after it was banned, until it was forgotten too.
A token issued by a banned node is now refused (BannedIssuer), as soon
as the ban reaches the node judging it.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/docs/access.md b/docs/access.md index 107de8d..a85dfa4 100644 --- a/docs/access.md +++ b/docs/access.md @@ -106,8 +106,8 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued - before aren't taken any more. A token of a node forgotten by the swarm isn't taken - either. In a swarm without a registry, a token is taken until it expires. + before aren't taken any more. A token of a node banned or forgotten by the swarm isn't + taken either. In a swarm without a registry, a token is taken until it expires. * **What it means to trust**: any member could sign a token for any user, as it could write anything as anyone ([`trust.md`](trust.md)). A token is a bearer's: whoever holds it is the user until it ends, so it goes over TLS only, as passwords do. @@ -307,7 +307,7 @@ A node can be banned: `_continuum/banned/<node ID>`, written by a user who may w there (protocol data). Every node then leaves its handshakes unanswered, so it is neither synced with nor counted a member, and with the policy every node refuses the changes it commits from then on, judged as the ban stood when they were made (what it -wrote before stays). Deleting the entry lifts the ban. A ban doesn't remove the node +wrote before stays), and the tokens it issued. Deleting the entry lifts the ban. A ban doesn't remove the node from the member list: forget it too (`DELETE /peers/<node ID>`). ```sh |