diff options
Diffstat (limited to 'docs/dashboard.md')
| -rw-r--r-- | docs/dashboard.md | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/docs/dashboard.md b/docs/dashboard.md index 1a0ae86..7f64034 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -21,8 +21,11 @@ dashboard without one is sent to. There, a user logs in with its password [`access.md`](access.md), Tokens), or any other. The page keeps a session for the browser, a cookie no script reads and no other site's page sends, renewed while the dashboard is open; it ends with the token's lifetime, or with "Log out of this -browser". The page and the login page run their own script only (a content security -policy naming it by its hash), and no other page may frame them. The API listens on localhost unless `--bind-addr` says otherwise; +browser" on the login page, or "log out" on the dashboard, which ends this browser's +session only. Where the page got in by what it can't end, the browser's password or +the proxy's, it says so beside the user's name. The page and the login page run their +own script only (a content security policy naming it by its hash), and no other page +may frame them. The API listens on localhost unless `--bind-addr` says otherwise; to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000 <machine>`) or put a TLS proxy in front ([`operations.md`](operations.md), Behind a reverse proxy). |