From f315b94c024fea5ac228da15e24a2f3f717ddac2 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 18:14:24 +0000 Subject: docs: what a junk logout does Review 2, N11: a value at _continuum/logouts/ that isn't a time (read as damaged: every token revoked), or one far ahead, refuses every token of the user, new ones too, until it is replaced. Any member can write it (finding 10). The rules can't see the value (only that it is written), so access.md says it, and how it is set right: the user logs out again by password, or one who manages users revokes its tokens. --- docs/access.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'docs') diff --git a/docs/access.md b/docs/access.md index 458c2dd..657ab94 100644 --- a/docs/access.md +++ b/docs/access.md @@ -115,7 +115,11 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store before aren't taken any more. A token of a node banned or forgotten by the swarm isn't taken either. In a swarm without a registry, a token is taken until it expires. The user a logout names is its node's word, and a logout no deciding path, even under a - strict policy: any member could log any user out. It ends sessions, nothing more. + strict policy: any member could log any user out. It ends sessions; and a value there + that isn't a time, or one far ahead, refuses every token of the user, its new ones + too, until it is replaced: by the user logging out again by password + (`POST /auth/logout`), or by one who manages users (`DELETE + /admin/users/{name}/tokens`). * **What it means to trust**: any member could sign a token for any user, as it could write anything as anyone ([`trust.md`](trust.md)). A token is a bearer's: whoever holds it is the user until it ends, so it goes over TLS only, as passwords do. -- cgit v1.3.1