On Tue, Sep 03, 2013 at 09:57:45AM +0200, Petr Vobornik wrote: > > It has one drawback. You won't have access to the token if you open > new instance of Web UI because you already have a session and > therefore don't need to log in. > > I suppose we can create a new handler (can't be a command) which new > Web UI instance would call to obtain the token. Special care would
Right. Well, you can actually make it a lazy thing -- only make the call to get the token before any POST is done (and the JS does not have the token). Chances are, if the user is only viewing things on the WebUI without modifying anything, you won't need the token at all. -- Jan Pazdziora | adelton at #ipa*, #brno Principal Software Engineer, Identity Management Engineering, Red Hat _______________________________________________ Freeipa-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-devel
