diff options
| author | tv <tv@krebsco.de> | 2026-11-08 14:12:39 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 15:25:54 +0100 |
| commit | 5de2994c6d8f5f266d60b4febdf9252a035488ad (patch) | |
| tree | 47424d1b16ddb58e4d6ccd3dbd3b109369d04e26 /docs/openapi.yaml | |
| parent | 84a137b4db8d901848df8e06dc45dfca2206dbae (diff) | |
login: a token asked to live less ends its session with it
Review finding 8, first part: a refreshed token's lifetime came from
the refresh request, and it kept the session's end. So the five-minute
read-all token a dashboard hands to another member's refreshed into a
12-hour one, renewable for seven days.
A token asked to live less (`lifetime`, at login or refresh) now ends
its session with it: nobody refreshes it past its end, its holder
included, and a session begun from it (POST /auth/session) ends then
too.
Diffstat (limited to 'docs/openapi.yaml')
| -rw-r--r-- | docs/openapi.yaml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/openapi.yaml b/docs/openapi.yaml index 960ab14..f0d54a9 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -1974,7 +1974,7 @@ components: items: { $ref: '#/components/schemas/CapabilityRequest' } lifetime: type: integer - description: Seconds the token lives, if less than `token-lifetime` (a token to hand over, say). + description: Seconds the token lives, if less than `token-lifetime` (a token to hand over, say). Its session ends with it, so it is not refreshed past its end. TokenAnswer: type: object properties: |