diff options
Diffstat (limited to 'docs/trust.md')
| -rw-r--r-- | docs/trust.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/trust.md b/docs/trust.md index fd37638..8b0f72a 100644 --- a/docs/trust.md +++ b/docs/trust.md @@ -34,7 +34,8 @@ secret like the swarm key: readable by its owner only (a node warns otherwise; a it creates is). **The HTTP API.** Every endpoint but the API description needs a user from -`--htpasswd`, or one a reverse proxy names (`--user-header`): the node believes that +`--htpasswd`, one a reverse proxy names (`--user-header`), or a token a node of the +swarm issued to one of those ([`access.md`](access.md), Tokens): the node believes that header from `--trusted-proxies` alone, but from those blindly, so whoever can send requests from there can be any user. With the default loopback addresses, that is every user of the host; with only the API's Unix socket (`--trusted-proxies unix`), those its |