X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/5727f64521ea7222422dd48e48793a0fe10253f4..4ce3a9012eb959cea8c784ff5efe9d44cefa2543:/doc/api/keep-web-urls.html.textile.liquid diff --git a/doc/api/keep-web-urls.html.textile.liquid b/doc/api/keep-web-urls.html.textile.liquid index 90df5b9fd6..1770a259b7 100644 --- a/doc/api/keep-web-urls.html.textile.liquid +++ b/doc/api/keep-web-urls.html.textile.liquid @@ -76,7 +76,7 @@ pre. http://collections.example.com/collections/uuid_or_pdh/foo/bar.txt h2(#same-site). Same-site requirements for requests with tokens -Although keep-web doesn't care about the domain part of the URL, the clients do: specially when rendering inline content. +Although keep-web doesn't care about the domain part of the URL, the clients do: especially when rendering inline content. When a client passes a token in the URL, keep-web sends a redirect response placing the token in a @Set-Cookie@ header with the @SameSite=Lax@ attribute. The browser will ignore the cookie if it's not coming from a _same-site_ request, and thus its subsequent request will fail with a @401 Unauthorized@ error.