Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

implement a session framework #86

Closed
chadwhitacre opened this issue Jul 25, 2012 · 5 comments
Closed

implement a session framework #86

chadwhitacre opened this issue Jul 25, 2012 · 5 comments

Comments

@chadwhitacre
Copy link
Contributor

No description provided.

@chadwhitacre
Copy link
Contributor Author

@pjz implemented http basic and digest at some point. We need cookie auth and a consistent documented interface to the whole.

chadwhitacre added a commit that referenced this issue Jul 25, 2012
@chadwhitacre
Start implementing cookie auth (#86)
25f95eb 
This adds a couple simple auth checks to the core request handling code
in website.py that don't depend on the hooks infrastructure, and a
configurable cookie authentication system that does depend on hooks.
Needs to be documented, and the method for turning auth "on" is much too
coarse.
@pjz
Copy link
Contributor

pjz commented Jul 25, 2012

I think the interface should be the existing hooks interface. Also, hook filters (aspen.hooks.filters.*) can then be used to control what does and doesn't require authorization.

@chadwhitacre
Copy link
Contributor Author

My concern with using the existing hooks interface is that users will inadvertently open up a security hole. We want to turn off caching for all authenticated requests, and we don't want users to be able to turn that on.

@pjz
Copy link
Contributor

pjz commented Jul 27, 2012

Maybe a wrapper for auth hooks that turns off the caching? so your hook is like: filter(dont_cache(auth_hook(...)))

@pjz
Copy link
Contributor

pjz commented Sep 21, 2013

replaced by #139

@pjz pjz closed this as completed Sep 21, 2013
Changaco pushed a commit that referenced this issue Mar 11, 2016
@chadwhitacre
Start implementing cookie auth (#86)
56ec9bb 
This adds a couple simple auth checks to the core request handling code
in website.py that don't depend on the hooks infrastructure, and a
configurable cookie authentication system that does depend on hooks.
Needs to be documented, and the method for turning auth "on" is much too
coarse.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@pjz @chadwhitacre