On 2/5/07, Chris Shenton <[EMAIL PROTECTED]> wrote: > > "Shannon -jj Behrens" <[EMAIL PROTECTED]> writes: > > > I think you're on the right path. It sounds like you're having a hard > > time figuring out what you should do than figuring out how to do it. > > If I had to implement different access controls based on different > > URLs, I'd probably just do it in base.py :-/ My biggest question is > > how do you know if someone is "internal"? > > I tried a bit but couldn't get "sub" paths working and ended up using > AuthKit's form-based auth, and putting auth checks in my private > controllers __init__ method. So internal users (well, our folks) get > a login screen and a menu wrapping the content via autohandler, and > outside folks see no auth screen and no menu. Seems to work but some > of my colleagues are worried about how secure AuthKit really is.
Don't embrace FUD (fear, uncertainty, and doubt). Rather, understand how it works, when it won't, etc. Even good software can be used insecurely. In contrast, if you want the ultimate in security, a DOS box with no floppy drive and no networking is indeed quite secure ;) Best Regards, -jj -- http://jjinux.blogspot.com/ --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "pylons-discuss" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/pylons-discuss?hl=en -~----------~----~----~----~------~----~------~--~---
