diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 5 | ||||
| -rw-r--r-- | docs/openapi.yaml | 3 |
2 files changed, 6 insertions, 2 deletions
diff --git a/docs/access.md b/docs/access.md index e3dec0b..567cebd 100644 --- a/docs/access.md +++ b/docs/access.md @@ -128,7 +128,10 @@ no keys (`409`). A browser keeps a token as its session: `POST /auth/session`, with a token, answers as `/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`, `SameSite=Strict`: no script reads it, no other site's page sends it), which lets in -requests without `Authorization`; `DELETE /auth/session` forgets it. The login page +requests without `Authorization` that read (`GET`, `HEAD`) or renew or end the session; one +that changes anything brings the token itself, which no other page, of another site or +of another port of the same host, can make a browser send. `DELETE /auth/session` +forgets it. The login page (`/login`, without authentication, with the dashboard) begins one by password or from a token pasted, from a login by key, say; the dashboard renews it while open ([`dashboard.md`](dashboard.md)). diff --git a/docs/openapi.yaml b/docs/openapi.yaml index bb1d34b..7c8bb84 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -902,7 +902,8 @@ paths: description: | As `POST /auth/refresh`, and the new token set as the session cookie (`continuum-token`, `HttpOnly`, `SameSite=Strict`, for as long as the token is - valid): requests without `Authorization` that bring it are its user's. + valid): requests without `Authorization` that bring it are its user's, if they + read (`GET`, `HEAD`) or renew or end the session; others bring the token themselves. security: - bearer: [] requestBody: |