From a99bacc0c90ca7a7f879cec8a8fb33f4aa14e84f Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: auth: the session cookie lets in reads only The cookie lets in GET, HEAD and the session's own requests; anything changing something brings the token itself, which no page of another site or port can make a browser send. The dashboard's writes send it. Auth plan M3 (browsers). --- docs/openapi.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'docs/openapi.yaml') diff --git a/docs/openapi.yaml b/docs/openapi.yaml index bb1d34b..7c8bb84 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -902,7 +902,8 @@ paths: description: | As `POST /auth/refresh`, and the new token set as the session cookie (`continuum-token`, `HttpOnly`, `SameSite=Strict`, for as long as the token is - valid): requests without `Authorization` that bring it are its user's. + valid): requests without `Authorization` that bring it are its user's, if they + read (`GET`, `HEAD`) or renew or end the session; others bring the token themselves. security: - bearer: [] requestBody: -- cgit v1.3.1