From b99e7ddf38233120ea19485968c12c5548e7fa61 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: auth: a login page and browser sessions GET /login without authentication: log in by password or with a token (from a login by key). POST/DELETE /auth/session keep the token as an HttpOnly, SameSite=Strict cookie; the dashboard sends a browser without a user there and renews the session while open. Auth plan M2/M3 (browsers). --- docs/dashboard.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'docs/dashboard.md') diff --git a/docs/dashboard.md b/docs/dashboard.md index 05069d1..df2d4f9 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -14,8 +14,14 @@ cargo build --release --features mycelium,dashboard ``` It is at `/admin/dashboard` on the node's HTTP API, by default -`http://127.0.0.1:3000/admin/dashboard`, and asks for a user from `--htpasswd` (or one -a reverse proxy names, `--user-header`), as the rest of the API does. The API listens on localhost unless `--bind-addr` says otherwise; +`http://127.0.0.1:3000/admin/dashboard`, for a user a reverse proxy names +(`--user-header`) or one logged in on the page `/login`, which a browser opening the +dashboard without one is sent to. There, a user logs in with its password +(`--htpasswd`), or with a token: from `continuum-signed login` (by key, +[`access.md`](access.md), Tokens), or any other. The page keeps a session for the +browser, a cookie no script reads and no other site's page sends, renewed while the +dashboard is open; it ends with the token's lifetime, or with "Log out of this +browser". The API listens on localhost unless `--bind-addr` says otherwise; to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000 `) or put a TLS proxy in front ([`operations.md`](operations.md), Behind a reverse proxy). -- cgit v1.3.1