diff options
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index 50c0265..988d619 100644 --- a/docs/access.md +++ b/docs/access.md @@ -124,7 +124,11 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued - before aren't taken any more. A token of a node banned or forgotten by the swarm isn't + before aren't taken any more. One session's (`DELETE /auth/session`, the dashboard's + "log out"): `_continuum/sessions/<name>/<session>`, until when the session would have + lasted, written by the user or one who manages users; a remake's snapshot leaves it + out once that has passed. Without a registry, the node ending it refuses the + session's tokens itself, until it restarts; others take them until they expire. A token of a node banned or forgotten by the swarm isn't taken either. In a swarm without a registry, a token is taken until it expires. The user a logout names is its node's word, and a logout no deciding path, even under a strict policy: any member could log any user out. It ends sessions; and a value there |