diff options
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index e3dec0b..567cebd 100644 --- a/docs/access.md +++ b/docs/access.md @@ -128,7 +128,10 @@ no keys (`409`). A browser keeps a token as its session: `POST /auth/session`, with a token, answers as `/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`, `SameSite=Strict`: no script reads it, no other site's page sends it), which lets in -requests without `Authorization`; `DELETE /auth/session` forgets it. The login page +requests without `Authorization` that read (`GET`, `HEAD`) or renew or end the session; one +that changes anything brings the token itself, which no other page, of another site or +of another port of the same host, can make a browser send. `DELETE /auth/session` +forgets it. The login page (`/login`, without authentication, with the dashboard) begins one by password or from a token pasted, from a login by key, say; the dashboard renews it while open ([`dashboard.md`](dashboard.md)). |