admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Browse Source
This commit is contained in:
John Cardinal
2021-12-14 17:27:51 +00:00
parent 18cf8800ee
commit c6cd22c462
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/8.0/ayanova/docs/ops-config-jwt-secret.md
View File

@@ -2,16 +2,16 @@
AyaNova uses JSON Web Tokens (JWT) for authentication.
These time limited tokens are signed by the server using a JWT secret key combined with a site specific identifier and issued to users when they log in to the AyaNova server.
These time limited tokens are signed by the server using a JWT secret key and issued to users when they log in to the AyaNova server.
Every time the user makes a request to the server the JWT is sent along as well and verified to be valid.
Tokens have a built in expiry mechanism of 5 days from issue.
Users can be prevented from logging in or accessing the server by setting them inactive which takes effect immediately regardless of how many days are left on their current access token.
All active tokens previously issued can be invalidated by changing this JWT Secret setting and restarting the server (or restarting the server and allowing it to choose a new secret value randomly if none is specified).
(Individual Users can be prevented from logging in or accessing the server by setting them inactive which takes effect immediately regardless of how many days are left on their current access token.)
## Default
If no secret key is specified the server will generate a new, random one each time it starts and this means that remote users who previously authenticated will need to login freshly if the server is restarted.