From a99bacc0c90ca7a7f879cec8a8fb33f4aa14e84f Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: auth: the session cookie lets in reads only The cookie lets in GET, HEAD and the session's own requests; anything changing something brings the token itself, which no page of another site or port can make a browser send. The dashboard's writes send it. Auth plan M3 (browsers). --- docs/access.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index e3dec0b..567cebd 100644 --- a/docs/access.md +++ b/docs/access.md @@ -128,7 +128,10 @@ no keys (`409`). A browser keeps a token as its session: `POST /auth/session`, with a token, answers as `/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`, `SameSite=Strict`: no script reads it, no other site's page sends it), which lets in -requests without `Authorization`; `DELETE /auth/session` forgets it. The login page +requests without `Authorization` that read (`GET`, `HEAD`) or renew or end the session; one +that changes anything brings the token itself, which no other page, of another site or +of another port of the same host, can make a browser send. `DELETE /auth/session` +forgets it. The login page (`/login`, without authentication, with the dashboard) begins one by password or from a token pasted, from a login by key, say; the dashboard renews it while open ([`dashboard.md`](dashboard.md)). -- cgit v1.3.1