__                 _ _                _
  / _| ___   ___   __| | |__   __ _ _ __| | __
 | |_ / _ \ / _ \ / _` | '_ \ / _` | '__| |/ /
 |  _| (_) | (_) | (_| | |_) | (_| | |  |   <
 |_|  \___/ \___/ \__,_|_.__/ \__,_|_|  |_|\_\

A personal BBS  ·  Missoula, Montana  ·  formerly NaClCON BBS

Connect from your terminal: telnet naclconbbs.net 23  |  ssh naclconbbs.net -p 2222

  1. Forum
  2. DOVE-Net
  3. Synchronet Programming

  • docs/v322_new.md exec/websocketservice.js

    From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Mon Aug 17 02:07:18 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/8d0d5456c03088c564d8c4c1
    Modified Files:
    docs/v322_new.md exec/websocketservice.js
    Log Message:
    websocketservice.js: separate the sidecar guarantee from the login policy

    -auth did two unrelated jobs, and welding them together made one of
    them unusable.

    The first is a safety property about the SIDECAR: forward nothing this
    instance could not describe. A backend reading the sidecar concludes
    from its absence that a connection was made directly to it, and may
    extend local trust on that basis, so a failed write has to close the
    connection rather than quietly produce one wearing a local client's
    clothes. That stays with -auth, which is the name the guarantee earned.

    The second is a POLICY about the person: refuse anyone with no web
    session. That belongs to the backend, not here. A backend may want
    anonymous visitors and have its own idea of how many to allow -- and it
    cannot express any of that if this instance turned them away first. It
    never saw them. Moving it out is what makes such a setting possible at
    all; keeping it as -login is so a backend that wants nobody anonymous
    need not implement refusing them.

    Neither may become the default. An instance fronting a server that does
    its own login carries people who have not logged in yet, because
    logging in is what they are connecting to do.

    Nothing in the tree passed -auth expecting the login behaviour, so no
    caller changes meaning under it.

    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    ---
    þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net