diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
| commit | ec70060ae5fa665953741da921e28031b56bc5e0 (patch) | |
| tree | cd1f6f5ae90d3ad87b9667da20d6e85b62394ab1 /docs/trust.md | |
| parent | eed8f86912f53f549d9f9068f9bdf2c8e23aa0f7 (diff) | |
auth: logging in, and tokens as bearers
POST /auth/login (by htpasswd or the proxy), /auth/refresh,
/auth/logout, GET /auth/whoami; every request may bring
Authorization: Bearer instead of a password. --token-lifetime and
--session-lifetime.
Auth plan M2.
Diffstat (limited to 'docs/trust.md')
| -rw-r--r-- | docs/trust.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/trust.md b/docs/trust.md index fd37638..8b0f72a 100644 --- a/docs/trust.md +++ b/docs/trust.md @@ -34,7 +34,8 @@ secret like the swarm key: readable by its owner only (a node warns otherwise; a it creates is). **The HTTP API.** Every endpoint but the API description needs a user from -`--htpasswd`, or one a reverse proxy names (`--user-header`): the node believes that +`--htpasswd`, one a reverse proxy names (`--user-header`), or a token a node of the +swarm issued to one of those ([`access.md`](access.md), Tokens): the node believes that header from `--trusted-proxies` alone, but from those blindly, so whoever can send requests from there can be any user. With the default loopback addresses, that is every user of the host; with only the API's Unix socket (`--trusted-proxies unix`), those its |