diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
| commit | 1458ea92a41788a0f33e86e621817613f46055eb (patch) | |
| tree | 8cbe202657c5f9eb006b9612d9dfa0a4b829d589 /docs/example.toml | |
| parent | aea80cf1bfa39f17dbbd0b4782a71fca81e09f74 (diff) | |
dashboard: own links over the API, and CORS
GET /admin/dashboard/links/own and its event stream: a node's own links,
as LINKS_REPLY carried them, for other members' dashboards with a
token. CORS for the members' dashboard origins and --cors-origins,
without credentials.
Auth plan M3.
Diffstat (limited to 'docs/example.toml')
| -rw-r--r-- | docs/example.toml | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/docs/example.toml b/docs/example.toml index ab8237c..222db52 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -78,6 +78,12 @@ htpasswd = "/etc/continuum/htpasswd" # the login's end (session-lifetime). # token-lifetime = "12h" +# Origins (scheme://host[:port]) whose pages may read this node's own links and refresh +# tokens here, with a token (docs/access.md, Tokens): the dashboards of other members are +# allowed anyway, as the member list names them (dashboard-url). Without credentials: a +# page sends its token itself. +# cors-origins = ["https://dashboard.example.org"] + # How long after a login (POST /auth/login) its tokens may be refreshed; then the user # logs in again. # session-lifetime = "7d" |