diff options
Diffstat (limited to 'docs/dashboard.md')
| -rw-r--r-- | docs/dashboard.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/dashboard.md b/docs/dashboard.md index 01507df..db599fb 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -21,7 +21,8 @@ dashboard without one is sent to. There, a user logs in with its password [`access.md`](access.md), Tokens), or any other. The page keeps a session for the browser, a cookie no script reads and no other site's page sends, renewed while the dashboard is open; it ends with the token's lifetime, or with "Log out of this -browser". The API listens on localhost unless `--bind-addr` says otherwise; +browser". The page and the login page run their own script only (a content security +policy naming it by its hash), and no other page may frame them. The API listens on localhost unless `--bind-addr` says otherwise; to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000 <machine>`) or put a TLS proxy in front ([`operations.md`](operations.md), Behind a reverse proxy). |