diff options
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/access.md b/docs/access.md index 83c39f9..cc35565 100644 --- a/docs/access.md +++ b/docs/access.md @@ -125,6 +125,14 @@ the signature must be by one of the user's keys, as the registry the node holds says, and the user enabled (`401` if not, saying why). A swarm without a registry has no keys (`409`). +A browser keeps a token as its session: `POST /auth/session`, with a token, answers as +`/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`, +`SameSite=Strict`: no script reads it, no other site's page sends it), which lets in +requests without `Authorization`; `DELETE /auth/session` forgets it. The login page +(`/login`, without authentication, with the dashboard) begins one by password or from a +token pasted, from a login by key, say; the dashboard renews it while open +([`dashboard.md`](dashboard.md)). + `GET /auth/whoami` says who a request's user is, how it proved it, and what it may do. Pages of other origins, the dashboards of other members, may call a node with a token: |