diff options
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/docs/access.md b/docs/access.md index 71aebea..e8f9893 100644 --- a/docs/access.md +++ b/docs/access.md @@ -106,8 +106,9 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store `GET /auth/whoami` says who a request's user is, how it proved it, and what it may do. Pages of other origins, the dashboards of other members, may call a node with a token: -its own links (`/admin/dashboard/links/own`, and its events), `/auth/refresh` and -`/auth/whoami`, nothing else. A node allows the origins of the dashboards its member +its own links (`/admin/dashboard/links/own`, and its events) and traffic +(`/admin/dashboard/traffic/own/events`), `/auth/refresh` and `/auth/whoami`, nothing +else. A node allows the origins of the dashboards its member list names (`--dashboard-url`) and those of `--cors-origins`; without credentials (no cookie or password crosses origins: the page sends its token). |