From b99e7ddf38233120ea19485968c12c5548e7fa61 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: auth: a login page and browser sessions GET /login without authentication: log in by password or with a token (from a login by key). POST/DELETE /auth/session keep the token as an HttpOnly, SameSite=Strict cookie; the dashboard sends a browser without a user there and renews the session while open. Auth plan M2/M3 (browsers). --- src/api/dashboard/dashboard.html | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'src/api/dashboard/dashboard.html') diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html index 300f4fe..8146f32 100644 --- a/src/api/dashboard/dashboard.html +++ b/src/api/dashboard/dashboard.html @@ -2276,8 +2276,9 @@ function unapplySubscriptions() { } overlaid.clear(); } -// Tokens: this page's, from logging in on this node (the browser's password for it, or -// the proxy's), and a narrower one, reading the member list only, to send to others. +// Tokens: this page's, from logging in on this node (the browser's password for it, the +// proxy's, or the session the login page began), and a narrower one, reading the member +// list only, to send to others. // Each refreshed half way through its life. let token = null, narrowToken = null, tokenWhy = "not logged in yet", tokenTimer = null; const READ_MEMBERS = [{ path: ["_continuum", "members"], rights: ["read"] }]; @@ -2293,9 +2294,11 @@ async function tokenCall(url, bearer, body) { async function obtainTokens() { clearTimeout(tokenTimer); try { + // Refreshed as the session (`POST /auth/session`), whose cookie lets the page in; + // the first: by the browser's password or the proxy's, else by that cookie. token = token && token.expiresAt > Date.now() + 60000 - ? await tokenCall("../auth/refresh", token.token) - : await tokenCall("../auth/login"); + ? await tokenCall("../auth/session", token.token) + : await tokenCall("../auth/login").catch(() => tokenCall("../auth/session")); narrowToken = await tokenCall("../auth/refresh", token.token, { limit: READ_MEMBERS }); tokenWhy = null; const life = Math.min(token.expiresAt, narrowToken.expiresAt) - Date.now(); -- cgit v1.3.1