From 00b80d182363e03d447be0a6c1812ec46f8faee1 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 11:50:37 +0000 Subject: dashboard: tokens renewed after sleep too, never basic authentication MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The page renewed its token half way through its life by a timer. A timer fires late where the computer slept or the tab was in the background, by when the token (and the session cookie, which lives as long) may have ended: the page then fell back to `POST /auth/login`, which takes a password the browser keeps (basic authentication), and without one retried every 30 s, logged out without saying so. Now whether the token is half way through its life is looked at again when the page shows and every 30 s (`refreshIfDue`, one renewal at a time), so it is renewed while it still can be, until the login ends (`--session-lifetime`). Where the login ended, or there is none (400, 401, 403), the page goes to the login page; a node away is tried again in 30 s. And the page no longer gets in by a password the browser keeps: only by its session or through a proxy naming the user (`throughProxy`, `login: "header"`). The node never challenges a browser for a password either (`WWW-Authenticate`, the browser's prompt): not only on the dashboard's paths and for a page's own requests, but for any request with `Sec-Fetch-*` or a `Mozilla/…` user agent. curl sends the password unasked with `-u`, as before. --- docs/dashboard.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'docs') diff --git a/docs/dashboard.md b/docs/dashboard.md index da69a16..4973227 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -18,14 +18,16 @@ It is at `/admin/dashboard` on the node's HTTP API, by default (`--user-header`) or one logged in on the page `/login`, which a browser opening the dashboard without one is sent to. There, a user logs in with its password (`--htpasswd`, the same file the API's basic authentication takes, which the dashboard -never asks for itself: no browser password prompt), or with a token: from `continuum-signed login` (by key, +never asks for itself, nor takes from the browser: no browser password prompt, the +node never challenges a browser), or with a token: from `continuum-signed login` (by key, [`access.md`](access.md), Tokens), or any other. The page keeps a session for the browser, a cookie no script reads and no other site's page sends, renewed while the -dashboard is open; it ends with the token's lifetime, or with "Log out of this -browser" on the login page, or "log out" in the user's menu on the dashboard (its +dashboard is open (half way through the token's life, looked at again when the page +shows, so after the computer slept too) until the login ends (`--session-lifetime`), +then back to the login page; it ends with the token's lifetime once not renewed, or +with "Log out of this browser" on the login page, or "log out" in the user's menu on the dashboard (its name, top right), which ends this browser's session only. Where the page got in by -what it can't end, the browser's password or the proxy's, "log out" is greyed, and -says how instead. The menu's "credentials…" shows the user's keys, each by its name +what it can't end, the proxy's, "log out" is greyed, and says how instead. The menu's "credentials…" shows the user's keys, each by its name and as much of the key as fits the dialog, cut in the middle where it doesn't (its end and comment always shown, the whole in its tooltip), and `edit` at the right: its name and `.pub` line in fields, to save, or to delete with the red `Delete` (on a second -- cgit v1.3.1