Correct the "web client requires HTTPS" claim across the wiki The client now runs over plain http:// using Media Source Extensions, so the pages saying it could not — and specifically that it "cannot be worked around in JavaScript" — were wrong and are corrected rather than softened. Web-Client-Requires-HTTPS rewritten: what each path gives you in a table, why the difference exists, and an explicit note that the page previously said the opposite. The filename is kept so existing links and any URLs already shared do not 404, but the title and link text are now "Web client and HTTPS". Troubleshooting's first web-client question was "are you on HTTPS?", which is no longer the useful question. It now asks about the WebSocket URLs and their scheme, which is the actual common failure — ws:// from an HTTPS page is refused as mixed content. Advice on getting a trusted certificate on an internal network is unchanged and still correct; HTTPS remains the better path.

marcpope committed Jul 27, 2026

Restructure the wiki: welcome, install, upgrade, features, documentation The index mixed four feature pages in with installation and called the rest "Operations". Nine of the console's features had no page at all, so anyone wanting to know what the software actually does had to read the README and guess. Home is now Welcome -> Install -> Upgrade -> Features -> Documentation, with the feature list as a table linking to a page per feature. New pages: What CortenDesk Is what it does, what it is NOT (not a RustDesk server, no patched client), and how the two paths fit together Devices and Device Groups presence, aliases, folders, pre-registration, the approval gate, recycle bin Users and Access Scoping the exact visibility rule, and that it governs the client API too, not just the console Roles and Delegated Admin the eight areas and three levels Address Books personal vs shared, share rules, tags Audit Logs the five screens, alarm types, retention Automation API tokens, envelope, endpoints, --assign Email and Invitations SMTP, invites, reset, sign-in codes Web Client what it does and why it needs HTTPS Dashboard and Active Sessions stats, and how ending a session really works Settings Reference all six tabs, every setting, real defaults Command-Line Reference every artisan command, break-glass first Importing from rustdesk-api dry-run first, and the non-bcrypt caveat Troubleshooting by symptom Every claim was checked against the source rather than the README. Four things the README got wrong or omitted, now correct in the wiki: - The online window default is 60 seconds, not 30. - API tokens live under Settings -> Security, not their own tab, and support an expiry date. - Trusted proxies already default to loopback plus all RFC1918, so the "everyone shares one IP" advice only applies to a proxy on a public address or a hand-set list. - Most important: password sign-in does NOT come back on its own when the identity provider is merely unreachable. localLoginDisabled() gates on isConfigured(), which only checks that the discovery URL, client ID and secret are non-empty -- it never touches the network. A provider that is down while still configured leaves the password form hidden. The actual break-glass is CORTENDESK_OIDC_DISABLED=true. The SSO page claimed the safer-sounding version; both it and the new Settings Reference now state the real behaviour, since getting this wrong locks someone out of their own console. Install examples bumped 0.9.0 -> 0.9.6. All 24 pages link-checked, and the forbidden-content scan is clean.

marcpope committed Jul 26, 2026