diff options
| author | tv <tv@krebsco.de> | 2026-11-08 16:14:07 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 17:36:09 +0100 |
| commit | a7c70346b448f493991df1e035beaa4bde113b4f (patch) | |
| tree | 9f26c4ddc79c42bcf2aaa7afda3002bb6602e207 /docs/dashboard.md | |
| parent | ab595dfb91e66a8beda9b2dd407a4fceebe3b977 (diff) | |
auth: no basic authentication offered to the dashboard
What is meant for browsers logs in on its page (/login), with the
passwords of --htpasswd; basic authentication's challenge stays for the
API, so curl -u keeps working. 1164 kept it from a page's own requests;
now nothing under /admin/dashboard is challenged either, whatever the
request: a browser opening the page without a user is sent to /login,
anything else answered 401 without a challenge.
Diffstat (limited to 'docs/dashboard.md')
| -rw-r--r-- | docs/dashboard.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/dashboard.md b/docs/dashboard.md index 7f64034..027e094 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -17,7 +17,8 @@ It is at `/admin/dashboard` on the node's HTTP API, by default `http://127.0.0.1:3000/admin/dashboard`, for a user a reverse proxy names (`--user-header`) or one logged in on the page `/login`, which a browser opening the dashboard without one is sent to. There, a user logs in with its password -(`--htpasswd`), or with a token: from `continuum-signed login` (by key, +(`--htpasswd`, the same file the API's basic authentication takes, which the dashboard +never asks for itself: no browser password prompt), or with a token: from `continuum-signed login` (by key, [`access.md`](access.md), Tokens), or any other. The page keeps a session for the browser, a cookie no script reads and no other site's page sends, renewed while the dashboard is open; it ends with the token's lifetime, or with "Log out of this |