Will a user without access permission bypass access control in web terminal?

[wxiaoguang]

For my understanding, teleport's access control heavily depends the result of filtered GetNodes

But in terminal.go line L111

https://github.com/gravitational/teleport/blob/master/lib/web/terminal.go#L111

It seems that the logic doesn't respect the result of GetNodes

eg: even if a user have an empty node list, the code will still run to return &TerminalHandler{} to return a new terminal ?

[klizhentas]

Teleport's access control is based on the client certificates, even if someone was to learn the name of the host, they won't be able to access the server because they will get rejected on the SSH level. In this sense, Web SSH is just another client to the target node.