diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:22 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:22 +0100 |
| commit | a99bacc0c90ca7a7f879cec8a8fb33f4aa14e84f (patch) | |
| tree | 2de7dfad5ac866df8e90560a06e93a47a8f7f173 /docs/openapi.yaml | |
| parent | 91d1bb60cb7a8d92e4e1966dabbcb50a2406c75e (diff) | |
auth: the session cookie lets in reads only
The cookie lets in GET, HEAD and the session's own requests; anything
changing something brings the token itself, which no page of another
site or port can make a browser send. The dashboard's writes send it.
Auth plan M3 (browsers).
Diffstat (limited to 'docs/openapi.yaml')
| -rw-r--r-- | docs/openapi.yaml | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/openapi.yaml b/docs/openapi.yaml index bb1d34b..7c8bb84 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -902,7 +902,8 @@ paths: description: | As `POST /auth/refresh`, and the new token set as the session cookie (`continuum-token`, `HttpOnly`, `SameSite=Strict`, for as long as the token is - valid): requests without `Authorization` that bring it are its user's. + valid): requests without `Authorization` that bring it are its user's, if they + read (`GET`, `HEAD`) or renew or end the session; others bring the token themselves. security: - bearer: [] requestBody: |