diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/dashboard.md | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/docs/dashboard.md b/docs/dashboard.md index 4973227..4948c03 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -15,8 +15,9 @@ cargo build --release --features mycelium,dashboard It is at `/admin/dashboard` on the node's HTTP API, by default `http://127.0.0.1:3000/admin/dashboard`, for a user a reverse proxy names -(`--user-header`) or one logged in on the page `/login`, which a browser opening the -dashboard without one is sent to. There, a user logs in with its password +(`--user-header`) or one logged in on the page `/login`, which the dashboard's page +(served to anyone: it holds nothing, and reads what it shows with the browser's +session) goes to at once without one. There, a user logs in with its password (`--htpasswd`, the same file the API's basic authentication takes, which the dashboard never asks for itself, nor takes from the browser: no browser password prompt, the node never challenges a browser), or with a token: from `continuum-signed login` (by key, @@ -258,8 +259,9 @@ measured. (`--dashboard-url`, in the member list; e.g. behind a reverse proxy, [`operations.md`](operations.md)). A token from this node goes along, reading the member list only, for five minutes, enough for the map: where the browser has no - session at the other dashboard, its login page begins one with it (log in there to - see more), unless its proxy asks for credentials of its own. Whoever publishes the + session at the other dashboard, the page there begins one with it before it reads + anything, with no login page in between (log in there to see more), unless its proxy + asks for credentials of its own. Whoever publishes the dashboard (a member writes its own URL) gets that token, no more. It goes in the address's fragment, which the other page takes out at once; where that page never loads (an error, a proxy's own login), it stays in the address bar and the history, |