diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:22 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:22 +0100 |
| commit | a99bacc0c90ca7a7f879cec8a8fb33f4aa14e84f (patch) | |
| tree | 2de7dfad5ac866df8e90560a06e93a47a8f7f173 /src/simtest | |
| parent | 91d1bb60cb7a8d92e4e1966dabbcb50a2406c75e (diff) | |
auth: the session cookie lets in reads only
The cookie lets in GET, HEAD and the session's own requests; anything
changing something brings the token itself, which no page of another
site or port can make a browser send. The dashboard's writes send it.
Auth plan M3 (browsers).
Diffstat (limited to 'src/simtest')
0 files changed, 0 insertions, 0 deletions