From 0f55d5741b3dfda617670f92a77c3cd6e462be6d Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:36:49 +0000 Subject: dashboard: log out of this browser, and say what can't be The dashboard had no way to log out; only the login page did. It now shows the user beside the connection, and "log out" where the page got in by its session: that ends this browser's session (DELETE /auth/session), other sessions of the user going on, and opens the login page. Where it got in by what it can't end, the browser's password or the proxy's, it says so instead (the token answer now names `login`, how the user proved it). After logging out, a page still let in by the browser's password says so too. A list of a user's sessions, to end one by one, is in future-work.md. --- docs/dashboard.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'docs/dashboard.md') diff --git a/docs/dashboard.md b/docs/dashboard.md index 1a0ae86..7f64034 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -21,8 +21,11 @@ dashboard without one is sent to. There, a user logs in with its password [`access.md`](access.md), Tokens), or any other. The page keeps a session for the browser, a cookie no script reads and no other site's page sends, renewed while the dashboard is open; it ends with the token's lifetime, or with "Log out of this -browser". The page and the login page run their own script only (a content security -policy naming it by its hash), and no other page may frame them. The API listens on localhost unless `--bind-addr` says otherwise; +browser" on the login page, or "log out" on the dashboard, which ends this browser's +session only. Where the page got in by what it can't end, the browser's password or +the proxy's, it says so beside the user's name. The page and the login page run their +own script only (a content security policy naming it by its hash), and no other page +may frame them. The API listens on localhost unless `--bind-addr` says otherwise; to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000 `) or put a TLS proxy in front ([`operations.md`](operations.md), Behind a reverse proxy). -- cgit v1.3.1