Bug 914196 - Documentation for User.login should state cookies not used for JSONRPC...

r/a=glob

diff --git a/Bugzilla/WebService/User.pm b/Bugzilla/WebService/User.pm
index ba8640f3d7ee729823f1ea1168234b1fda8940c2..22306a11f7f8996fc4e45a43a1810b36f5909ded 100644 (file)
--- a/Bugzilla/WebService/User.pm
+++ b/Bugzilla/WebService/User.pm
@@ -466,7 +466,9 @@ user that was logged in, and a C<token> which can be passed in
 the parameters as authentication in other calls. A set of http cookies
 is also sent with the response. These cookies *or* the token can be sent
 along with any future requests to the webservice, for the duration of the
-session.
+session. Note that cookies are not accepted for GET requests for JSONRPC
+and REST for security reasons. You may, however, use the token or valid
+login parameters for those requests.
 
 =item B<Errors>