From 5de2994c6d8f5f266d60b4febdf9252a035488ad Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:12:39 +0000 Subject: login: a token asked to live less ends its session with it Review finding 8, first part: a refreshed token's lifetime came from the refresh request, and it kept the session's end. So the five-minute read-all token a dashboard hands to another member's refreshed into a 12-hour one, renewable for seven days. A token asked to live less (`lifetime`, at login or refresh) now ends its session with it: nobody refreshes it past its end, its holder included, and a session begun from it (POST /auth/session) ends then too. --- docs/openapi.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs/openapi.yaml') diff --git a/docs/openapi.yaml b/docs/openapi.yaml index 960ab14..f0d54a9 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -1974,7 +1974,7 @@ components: items: { $ref: '#/components/schemas/CapabilityRequest' } lifetime: type: integer - description: Seconds the token lives, if less than `token-lifetime` (a token to hand over, say). + description: Seconds the token lives, if less than `token-lifetime` (a token to hand over, say). Its session ends with it, so it is not refreshed past its end. TokenAnswer: type: object properties: -- cgit v1.3.1