From 44dff82eb11e86d407bf6fa22ec94c7d49fb919d Mon Sep 17 00:00:00 2001 From: Lee Calcote Date: Sun, 21 Jan 2024 20:51:50 -0600 Subject: [PATCH 1/2] New: Sessions Signed-off-by: Lee Calcote --- content/en/cloud/security/sessions.md | 29 ++++ content/en/cloud/security/tokens.md | 229 ++------------------------ 2 files changed, 44 insertions(+), 214 deletions(-) create mode 100644 content/en/cloud/security/sessions.md diff --git a/content/en/cloud/security/sessions.md b/content/en/cloud/security/sessions.md new file mode 100644 index 00000000..05faeb24 --- /dev/null +++ b/content/en/cloud/security/sessions.md @@ -0,0 +1,29 @@ +--- +title: Sessions +description: > + User sessions are created each time a user successfully authenticates. +date: 2024-01-24 +weight: 3 +--- + +## What sessions are + +A session is a period of time in which a user is authenticated to Layer5 Cloud. Sessions are created each time a user successfully authenticates. Sessions expire after a period of inactivity, which defaults to 72 hours but can be configured to any value between 15 minutes and 72 hours. + +Layer5 Cloud sessions use [OAuth 2.0](https://oauth.net/2/) for authentication. OAuth 2.0 is a standard protocol for authorization and focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and so on. + +Session OAuth tokens are stored in your user-agent (web browser) in a cookie. The cookie is named `meshery_session` and is a [signed cookie](https://expressjs.com/en/advanced/best-practice-security.html#use-signed-cookies). The cookie is only sent over HTTPS and is not accessible to JavaScript running in the browser. + +## Creating and using sessions + +A session is created each time a user successfully authenticates. See all active sessions on your [user account's security sessions page](https://meshery.layer5.io/security/sessions). + +To use a session, sign into your Layer5 Cloud user account, thereby creating a new session. Your session's token will automatically be stored in your web browser using a cookie. To use that same session, simply use the same browser until the session expires. You can have multiple sessions active concurrently, whether on the same device or different device. Each session recevies it's own authentication token and expiry time. + + In this way, it is possible to use your same account to collaborate between different sessions that you have established. For example, you may use those two different sessions to open up the same MeshMap design and you will find that your avatar shows up twice in the design (along with your mouse cursor). You can use this to collaborate with yourself or with others. We recommend collaborating with others, though. + +## Revoking sessions + +You can revoke your sessions at any time. When you revoke a session, it is immediately invalidated and cannot be used to make requests to the API. Revoking a session also revokes any refresh tokens associated with that session. + +See [Sessions](https://meshery.layer5.io/security/sessions) in Layer5 Cloud. diff --git a/content/en/cloud/security/tokens.md b/content/en/cloud/security/tokens.md index 7ce553b3..7a8b026b 100644 --- a/content/en/cloud/security/tokens.md +++ b/content/en/cloud/security/tokens.md @@ -2,235 +2,36 @@ title: Tokens description: > API Tokens are used to authenticate to Layer5 Cloud's REST API. Generated on your user account's security tokens page. Tokens can be revoked at any time. -date: 2023-10-28 +date: 2024-01-24 weight: 3 --- -{{% pageinfo %}} -This is a placeholder page. Replace it with your own content. -{{% /pageinfo %}} +## What tokens are +For authentication and authorization, a token is a digital object that contains information about the identity of the principal making the request and what kind of access they are authorized for. In most authentication flows, the application—or a library used by the application—exchanges a credential for a token, which determines which resources the application is authorized to access. -