The status page on this node is built the way the previous chapter recommends,

and it is a small worked example of the whole problem.

It accepts three things: an allow-listed identity, a valid session token, or a

password. Any one of them is enough.

The identity list deliberately does not live next to the page as a .allowed

file. It cannot, because NomadNet enforces .allowed inside the node before the

page script runs - with such a file present, the password path could never be

reached, because the script would never execute to offer it. The list therefore

sits outside the pages directory and is checked by the page itself, which also

means it is never served to anyone.

Signing in with the password issues a session token that rides along on the

page's own refresh link, with a sliding expiry. That is what makes the page

survive a restart: the token is stored, and identification is not.

There is a rate limit on wrong passwords, with one deliberate exception -

sessions that already exist keep working while new logins are blocked. So

somebody hammering the password cannot lock the operator out of their own node,

which would turn an annoyance into a denial of service.

The password hash and the session store both live outside the pages directory,

for the same reason the identity list does.

<- Prev Chapter Next Chapter ->