From 5de2994c6d8f5f266d60b4febdf9252a035488ad Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:12:39 +0000 Subject: login: a token asked to live less ends its session with it Review finding 8, first part: a refreshed token's lifetime came from the refresh request, and it kept the session's end. So the five-minute read-all token a dashboard hands to another member's refreshed into a 12-hour one, renewable for seven days. A token asked to live less (`lifetime`, at login or refresh) now ends its session with it: nobody refreshes it past its end, its holder included, and a session begun from it (POST /auth/session) ends then too. --- docs/access.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 7c576b0..a3b8864 100644 --- a/docs/access.md +++ b/docs/access.md @@ -100,8 +100,9 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store * **How long**: `--token-lifetime` (12 hours), refreshed (`POST /auth/refresh`, on any node, which signs the new one) until `--session-lifetime` (7 days) after the login; then the user logs in again. A refreshed token may say less (`limit`), never more, - and live less (`lifetime`, in seconds): a dashboard opening another member's hands it - one reading only, for five minutes ([`dashboard.md`](dashboard.md)). + and live less (`lifetime`, in seconds), and then ends its session with it: nobody + refreshes it past its end. A dashboard opening another member's hands it one reading + only, for five minutes ([`dashboard.md`](dashboard.md)). * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/`: tokens issued -- cgit v1.3.1