From c9cc9bc0cb03ce6471804f0e66967d94978898ee Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 11:59:44 +0000 Subject: dashboard: going to another node's dashboard without its login page in between Going to another member's dashboard showed its login page for a moment: a browser without a session there was sent from `/admin/dashboard` to `/login` (by `auth::basic_auth`), which began a session with the token handed over and went on to the dashboard. Now the dashboard's page is served without authentication, as the login page is (it holds nothing: what it shows it reads with the browser's session). Opened with a token handed over, the page begins the session with it (`POST /auth/session`) before it reads anything; without a session, `obtainTokens` goes to the login page, as the redirect did. A request without credentials is refused at once rather than after the 1.5 s that slow down guessing passwords: nothing is guessed there, and a page without a session goes to the login page without waiting twice for it. --- src/api/dashboard/dashboard.html | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'src/api/dashboard/dashboard.html') diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html index d32fa7a..dd37f29 100644 --- a/src/api/dashboard/dashboard.html +++ b/src/api/dashboard/dashboard.html @@ -4374,7 +4374,19 @@ remakeForm.addEventListener("submit", event => { .catch(error => remakeResult("Proposing failed: " + error, true)); }); -connect(); +// Opened from another member's page (`handOver`) with a token: it begins this browser's +// session here before anything is read, with no login page in between. Without a +// session, `obtainTokens` goes to the login page. +(async () => { + if (handOver && typeof handOver.token === "string") { + try { + await tokenCall("../auth/session", handOver.token); + } catch (_) { /* a session of this browser's own may let it in still */ } + delete handOver.token; + } + connect(); + obtainTokens(); +})(); // A page not shown (another tab, a minimised window) is paused: hidden for a while, it // closes its stream, so the node stops building updates and asking members for their // links for it; shown again, it reconnects. Briefly hidden, nothing changes. -- cgit v1.3.1