diff options
Diffstat (limited to 'webd/README.md')
| -rw-r--r-- | webd/README.md | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/webd/README.md b/webd/README.md index ac95fdb..7765d54 100644 --- a/webd/README.md +++ b/webd/README.md | |||
| @@ -94,8 +94,10 @@ location = /ws { | |||
| 94 | 94 | ||
| 95 | ## Behaviour | 95 | ## Behaviour |
| 96 | 96 | ||
| 97 | - The WebSocket handshake sets an HttpOnly, SameSite=Strict session cookie. | 97 | - The WebSocket handshake sets an HttpOnly, SameSite=Strict session cookie |
| 98 | There is no credential storage in the browser or gateway. | 98 | (`__Host-zagan_session` on HTTPS, `zagan_session` for local HTTP testing; the |
| 99 | `__Host-` prefix stops a sibling origin from fixing a domain cookie). There is | ||
| 100 | no credential storage in the browser or gateway. | ||
| 99 | - A browser close starts the grace window. Upstream stays connected, crash | 101 | - A browser close starts the grace window. Upstream stays connected, crash |
| 100 | ticks are still applied to the core, and a reconnect with the same cookie | 102 | ticks are still applied to the core, and a reconnect with the same cookie |
| 101 | gets the current `View`. Expiry closes upstream; the server forfeits a live | 103 | gets the current `View`. Expiry closes upstream; the server forfeits a live |