From b99e7ddf38233120ea19485968c12c5548e7fa61 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: auth: a login page and browser sessions GET /login without authentication: log in by password or with a token (from a login by key). POST/DELETE /auth/session keep the token as an HttpOnly, SameSite=Strict cookie; the dashboard sends a browser without a user there and renews the session while open. Auth plan M2/M3 (browsers). --- docs/access.md | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 83c39f9..cc35565 100644 --- a/docs/access.md +++ b/docs/access.md @@ -125,6 +125,14 @@ the signature must be by one of the user's keys, as the registry the node holds says, and the user enabled (`401` if not, saying why). A swarm without a registry has no keys (`409`). +A browser keeps a token as its session: `POST /auth/session`, with a token, answers as +`/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`, +`SameSite=Strict`: no script reads it, no other site's page sends it), which lets in +requests without `Authorization`; `DELETE /auth/session` forgets it. The login page +(`/login`, without authentication, with the dashboard) begins one by password or from a +token pasted, from a login by key, say; the dashboard renews it while open +([`dashboard.md`](dashboard.md)). + `GET /auth/whoami` says who a request's user is, how it proved it, and what it may do. Pages of other origins, the dashboards of other members, may call a node with a token: -- cgit v1.3.1