GWT-Cryto library

2008-12-22 Thread Xavier M.
Hello,
Just a post to make notice of the GWT-Crypto library. It is a quite old (one
year old)) project which enables crypto on the client side, actually on a
GWT client. I wonder if this could not be useful for the restlets project
for securing data transfer between client and server along the other
possibilities offered by Restlets.
http://code.google.com/p/gwt-crypto
regards

-- 
Xavier Méhaut

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989491

Router class not matching a URI with corresponding Template correctly

2008-12-22 Thread prashantideal
Hi All,

I am new to Restlets even after working for around last 8 months on restlets. 
:-)

I am facing a problem with my application.

Description is as follows:

In my application class I have two REST URIs as given below:

(1st) /language/{var1}/{var2}/
(2nd) /language/{var1}/{var2}/java/

I have also set Default matching mode of the router to MODE_EQUALS.

Now, if I test second URI with not providing value for one of the varibales e.g.
/language/12345/java/ 
(Note: value for var1 is missing in this URI)

My Router is matching this URI with first URI template and executes restlet 
class assgined to first URI i.e /language/{var1}/{var2}/

Ideally if i have set matching mode to MODE_EQUALS for router it should show a 
message server has not found anything matching requested URI with response 
code 404.

Please help me coming out of this problem. I have also tries with changin type 
of default varibale but no luck.

Thanks in advance.
Prashant

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989509


Re: securing Restlet

2008-12-22 Thread Stephan Koops
Ho Rhett,
 but doesn't the current Guard implementation obviate the need for  
 both
 sessions and cookies, and yet provide us with basic authentication?
 if yes,
 then a solution for providing customizable form-based login could be
 to
 extend its capabilities to allow declaring and re-directing to a
 resource
 URI to use when the credentials are missing.

 does this make sense?
 
 No, that won't work.  The reason why basic auth works without
 prompting after the first request is that the browser caches the
 credentials and repeats the Authorization header with every  
 subsequent
 request.  This is possible because basic authentication is part of  
 the
 HTTP spec.  There's no form-based equivalent of it.
   
 right.  and that's because in form-based authentication what  
 would've been a
 401 status code response never makes it to the Browser.  yes?
 

 I suppose that's one way to put it.  The key thing is that there's no  
 spec for form-based authentication, so there's no browser awareness of  
 it, so there's no way to get an Authorization header with form-based  
 auth.  That means the existing Guard implementation can't be trivially  
 modified to work with forms.
There is a way, but HTML and HTTP is not enough: You need JavaScript to 
send a XMLHttpRequest. But you can't use http state 401 for return, 
because the browser should prompt (search for 401 on 
http://www.w3.org/TR/XMLHttpRequest/) for the users credentials, and 
that is, what we don't want. So we hae to use another HTTP state for it 
(I've implemented it with the undefined state 491 some month ago).
But this way requires enabled JavaScript in the users browser and 
support for the XMLHttpRequest object.

best regards
   Stephan

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989565

Re: GWT-Cryto library

2008-12-22 Thread Stephan Koops
Hi Xavier,

what's the adventage against HTTPS?

best regards
  Stephan

Xavier M. schrieb:
 Hello,
 Just a post to make notice of the GWT-Crypto library. It is a quite 
 old (one year old)) project which enables crypto on the client side, 
 actually on a GWT client. I wonder if this could not be useful for the 
 restlets project for securing data transfer between client and server 
 along the other possibilities offered by Restlets.
 http://code.google.com/p/gwt-crypto
 regards

 -- 
 Xavier Méhaut

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989569


Re: GWT-Cryto library

2008-12-22 Thread Xavier Méhaut
to crypt only part of data when not on a https connection

2008/12/22 Stephan Koops stephan.ko...@web.de

 Hi Xavier,

 what's the adventage against HTTPS?

 best regards
  Stephan

 Xavier M. schrieb:
  Hello,
  Just a post to make notice of the GWT-Crypto library. It is a quite
  old (one year old)) project which enables crypto on the client side,
  actually on a GWT client. I wonder if this could not be useful for the
  restlets project for securing data transfer between client and server
  along the other possibilities offered by Restlets.
  http://code.google.com/p/gwt-crypto
  regards
 
  --
  Xavier Méhaut

 --

 http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989569




-- 
Xavier Méhaut
Directeur Informatique Groupe Visiodyn
Tel: +33(0) 254 800 583
Fax: +33(0) 254 800 592
Blog: http://it-tonic.blogspot.com/

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989584

Restlet 1.1 HTTP digest support

2008-12-22 Thread vidya vadke
Hi all,

Can anyone tell me whether restlet 1.1 supports HTTPS digest? If yes, it would 
be really great to get a pointer to a simple example.

Thanks,
-Vidya

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989570


Re: Router class not matching a URI with corresponding Template correctly

2008-12-22 Thread Thierry Boileau
prashantid...@gmail.com a écrit :
 Hi All,

 I am new to Restlets even after working for around last 8 months on restlets. 
 :-)

 I am facing a problem with my application.

 Description is as follows:

 In my application class I have two REST URIs as given below:

 (1st) /language/{var1}/{var2}/
 (2nd) /language/{var1}/{var2}/java/

 I have also set Default matching mode of the router to MODE_EQUALS.

 Now, if I test second URI with not providing value for one of the varibales 
 e.g.
 /language/12345/java/ 
 (Note: value for var1 is missing in this URI)

 My Router is matching this URI with first URI template and executes restlet 
 class assgined to first URI i.e /language/{var1}/{var2}/

 Ideally if i have set matching mode to MODE_EQUALS for router it should show 
 a message server has not found anything matching requested URI with 
 response code 404.

 Please help me coming out of this problem. I have also tries with changin 
 type of default varibale but no luck.

 Thanks in advance.
 Prashant

 --
 http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989509

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989587


RE: Re: Router class not matching a URI with corresponding Template correctly

2008-12-22 Thread prashantideal
Hi thboileau,

Did you reply for my question? I could not see any thing different than my 
original question.

Thanks
Prashant

 prashantid...@gmail.com a écrit :
  Hi All,
 
  I am new to Restlets even after working for around last 8 months on 
  restlets. :-)
 
  I am facing a problem with my application.
 
  Description is as follows:
 
  In my application class I have two REST URIs as given below:
 
  (1st) /language/{var1}/{var2}/
  (2nd) /language/{var1}/{var2}/java/
 
  I have also set Default matching mode of the router to MODE_EQUALS.
 
  Now, if I test second URI with not providing value for one of the varibales 
  e.g.
  /language/12345/java/ 
  (Note: value for var1 is missing in this URI)
 
  My Router is matching this URI with first URI template and executes restlet 
  class assgined to first URI i.e /language/{var1}/{var2}/
 
  Ideally if i have set matching mode to MODE_EQUALS for router it should 
  show a message server has not found anything matching requested URI with 
  response code 404.
 
  Please help me coming out of this problem. I have also tries with changin 
  type of default varibale but no luck.
 
  Thanks in advance.
  Prashant
 
  --
  http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989509

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989597


Re: Router class not matching a URI with corresponding Template correctly

2008-12-22 Thread Thierry Boileau
Hello prashant,

you can specify the type of a single variable as follow:
Route route = router.attach(/language/{var1}/{var2}/, restlet1);
route.getTemplate().getVariables().put(var1, new 
Variable(Variable.TYPE_ALPHA));


I also send you a sample application that illustrates this.

best regards,
Thierry Boileau

 Hi All,

 I am new to Restlets even after working for around last 8 months on restlets. 
 :-)

 I am facing a problem with my application.

 Description is as follows:

 In my application class I have two REST URIs as given below:

 (1st) /language/{var1}/{var2}/
 (2nd) /language/{var1}/{var2}/java/

 I have also set Default matching mode of the router to MODE_EQUALS.

 Now, if I test second URI with not providing value for one of the varibales 
 e.g.
 /language/12345/java/ 
 (Note: value for var1 is missing in this URI)

 My Router is matching this URI with first URI template and executes restlet 
 class assgined to first URI i.e /language/{var1}/{var2}/

 Ideally if i have set matching mode to MODE_EQUALS for router it should show 
 a message server has not found anything matching requested URI with 
 response code 404.

 Please help me coming out of this problem. I have also tries with changin 
 type of default varibale but no luck.

 Thanks in advance.
 Prashant

 --
 http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989509



--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989746import org.restlet.Application;
import org.restlet.Client;
import org.restlet.Component;
import org.restlet.Restlet;
import org.restlet.Route;
import org.restlet.Router;
import org.restlet.data.MediaType;
import org.restlet.data.Protocol;
import org.restlet.data.Request;
import org.restlet.data.Response;
import org.restlet.util.Variable;

public class TestApplication extends Application {
	public static void main(String[] args) throws Exception {
		Component component = new Component();
		component.getServers().add(Protocol.HTTP, 8182);
		component.getDefaultHost().attachDefault(new TestApplication());

		component.start();

		Client client = new Client(Protocol.HTTP);
		Response response = client
.get(http://localhost:8182/language/astring/java/;);
		response.getEntity().write(System.out);
		response = client
.get(http://localhost:8182/language/abc123/def456/java/;);
		response.getEntity().write(System.out);
		response = client.get(http://localhost:8182/language/1234/java/;);
		response.getEntity().write(System.out);
		component.stop();

	}

	@Override
	public Restlet createRoot() {
		Router router = new Router(getContext());
		Restlet restlet1 = new Restlet(getContext()) {
			@Override
			public void handle(Request request, Response response) {
response.setEntity(restlet1, MediaType.TEXT_PLAIN);
			}
		};
		Restlet restlet2 = new Restlet(getContext()) {
			@Override
			public void handle(Request request, Response response) {
response.setEntity(restlet2, MediaType.TEXT_PLAIN);
			}
		};
		Restlet restlet3 = new Restlet(getContext()) {
			@Override
			public void handle(Request request, Response response) {
response.setEntity(restlet3, MediaType.TEXT_PLAIN);
			}
		};

		Route route = router.attach(/language/{var1}/{var2}/, restlet1);
		route.getTemplate().getVariables().put(var1,
new Variable(Variable.TYPE_ALPHA));
		router.attach(/language/{var1}/{var2}/java/, restlet2);
		route = router.attach(/language/{var1}/{var2}/, restlet3);
		route.getTemplate().getVariables().put(var1,
new Variable(Variable.TYPE_DIGIT));
		return router;
	}
}


Re: how to redirect to another resource?

2008-12-22 Thread Thierry Boileau
Hello renfeng,

did you try to call the following methods on the request object?
 - request.getResourceRef().getBaseRef()
 - request.getHostRef()
 - request.getRootRef()

Otherwise, you can get the servletContext by casting the context:
ServletContextAdapter c = (ServletContextAdapter) context;
c.getServletContext();
But this method creates a strong coupling between your Restlet 
application and the Servlet container environment, and thus is not 
encouraged.

best regards,
Thierry Boileau


 I couldn't find a method to get the base url of ServerServlet. So it
 is hardcoded. Any clue how to retrieve it from the runtime
 environment? Thanks.

  String baseUrl = /context-root/restlet-root;
  router.attach(res1, new Redirector(
getContext(), baseUrl + res2,
Redirector.MODE_CLIENT_SEE_OTHER));




--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989754


Re: How to open a writer against the client

2008-12-22 Thread Thierry Boileau
Hello Ido,

what kind of representation were you using? a FileRepresentation?

best regards,
Thierry Boileau
 Hello Everyone,

 I have a problem: I need to send as a response to the client a big XML file - 
 can be even more than 30MB.

 What I need, I suppose, is to open an output writer and send the xml file in 
 chunks (if I try to read it all to the memory I get OutOfMemoryError and even 
 if I will increase the vm memory it won't be a solution for many users in the 
 same time).

 Any advice how can I do it? for now I use the StringRepresentation but it 
 doesn't work.

 Thanks,

 Ido

 --
 http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=988795



--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989759


Re: Restlet 1.1 HTTP digest support

2008-12-22 Thread Thierry Boileau
Hello Vidya,

you can have a look at this page of the wiki:
http://wiki.restlet.org/docs_1.1/13-restlet/27-restlet/46-restlet/112-restlet.html

which is accessible from the documentation page of the Restlet 1.1 
release on the Restlet web site 
(http://www.restlet.org/documentation/1.1/ and follow the user guide 
link).

best regards,
Thierry Boileau

 Hi all,

 Can anyone tell me whether restlet 1.1 supports HTTPS digest? If yes, it 
 would be really great to get a pointer to a simple example.

 Thanks,
 -Vidya

 --
 http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989570



--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989768


Re: a question about resolving urls for resources.

2008-12-22 Thread Thierry Boileau
Hello Antonio,

just to complete Michael's answer.
You seem to define 4 distincts resources (I mean subclass of 
org.restlet.Resource) as follow:
 - MailListResource attached to mail_list uri pattern
 - MailResource attached to ...
 - MailAttachmentListResource attached to ...
 - MailAttachmentResource attached to 
mail_list/{msg_ID}/attachment/{att_id} uri pattern

Thus, you define 4 routes:
router.attach(mail_list, MailListResource.class);
router.attach(...);
router.attach(...);
router.attach(mail_list/{msg_ID}/attachment/{att_id}, 
MailAttachmentResource.class);

The router is in charge, as said Michael, to match the current URI with 
the best pattern.

best regards,
Thierry Boileau

 Hi Antonio,

 By default a router will route requests to the best matching resource.
  So if two urls overlap, such as /mail_list and /mail_list/{msg_ID}
 then a request for /mail_list/abc will go to the second url as it
 matches more of the requested url than /main_list.

 Regards,
 Michael.

 On Thu, Dec 18, 2008 at 2:38 AM, antoniojg agall...@gmail.com wrote:
   
 Hello, I'm designing an application that retrieves some email messages from a
 DB back end.
 I'd like to use Rest to put and get messages on the db. A component is later
 responsible of retrieving them from the DB and storing them on a PEC  inboox
 and for getting mails from the inboox and storing them on the DB. The DB
 layer is essential for data maintenance since the inboox is constantly
 cleared.
 In my application each mail is identified by a msg_id and each mail can have
 several attachments

 So I have the following urls :

 mail_list  : get all the application related emails and post a new message

 mail_list/{msg_ID} in order to get, update and delete a specific message

 mail_list/{msg_ID}/attachment to get all the attachments and post a new one

 mail_list/{msg_ID}/attachment/{att_id}  to get, put and delete a specific
 attachment

 and so on.

 My doubt is related to how to configure the urls in order to manage requests
 for email specific attachments : mail_list/{msg_ID}/attachment/{att_id}

 There are two parameters here {msg_ID} and {att_id} . I can attach the
 resource mail list to the url /mail_list and the engine will be able to
 manage the parameter msg_ID through the API.

 However, how can I configure the mappings in order to reach the attachment
 resource if the url always starts with mail_list/{msg_ID}/attachment..?

 I' d be greatful isf someone may help me resolving this doubt.
 Thanks.
 Antonio.





 --
 View this message in context: 
 http://n2.nabble.com/a-question-about-resolving-urls-for-resources.-tp1668521p1668521.html
 Sent from the Restlet Discuss mailing list archive at Nabble.com.

 --
 http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=985841

 

 --
 http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=987160



--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989779


Response message before redirection

2008-12-22 Thread Mohamed Abdel-Aziz Bayoumi
Hello Dear Developers,

I'm developing a simple Restlets application that allows users to upload
files, which i process then provide them with links to download the output
processed files... I'm using a main Restlet that is an HTTP representation
including a form for upload and a summary table with recently uploaded files
and a link to download each ... 
When a file is uploaded using the HTML page's upload form, i specify the
action to a FileUploader resource (Restlet) from which i redirect again
permanently to the main restlet to avoid form's resubmission on refreshing
the main page ... 

Now all that i wanna do is provide my users with upload status notification
(a message ..  for example using getResponse().setEntity( File successfully
uploaded,MediaType.TEXT_PLAIN);) before redirecting them to the main page
(this is for users who consume my restlet from  code without using HTTP's
representation or GUI) Problem is  if i did both (i.e. provide message
before/then redirect to main page) the former is completely neglected and
all that they receive as a response from me is the HTTP representation
printed on their consoles httphead...etc due to redirection to the main
page .
   Is there any way they can receive the notification message while keeping
the HTTP main page redirection for those who use the latter ??  

Best Regards  
-- 
View this message in context: 
http://n2.nabble.com/Response-message-before-redirection-tp1690275p1690275.html
Sent from the Restlet Discuss mailing list archive at Nabble.com.

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989810


Re: securing Restlet

2008-12-22 Thread Rhett Sutphin
Hi Stephan,

On Dec 22, 2008, at 3:20 AM, Stephan Koops wrote:

 Ho Rhett,
 but doesn't the current Guard implementation obviate the need for
 both
 sessions and cookies, and yet provide us with basic  
 authentication?
 if yes,
 then a solution for providing customizable form-based login  
 could be
 to
 extend its capabilities to allow declaring and re-directing to a
 resource
 URI to use when the credentials are missing.

 does this make sense?

 No, that won't work.  The reason why basic auth works without
 prompting after the first request is that the browser caches the
 credentials and repeats the Authorization header with every
 subsequent
 request.  This is possible because basic authentication is part of
 the
 HTTP spec.  There's no form-based equivalent of it.

 right.  and that's because in form-based authentication what
 would've been a
 401 status code response never makes it to the Browser.  yes?

 I suppose that's one way to put it.  The key thing is that there's no
 spec for form-based authentication, so there's no browser awareness  
 of
 it, so there's no way to get an Authorization header with form-based
 auth.  That means the existing Guard implementation can't be  
 trivially
 modified to work with forms.
 There is a way, but HTML and HTTP is not enough: You need JavaScript  
 to send a XMLHttpRequest. But you can't use http state 401 for  
 return, because the browser should prompt (search for 401 on 
 http://www.w3.org/TR/XMLHttpRequest/) 
  for the users credentials, and that is, what we don't want. So we  
 hae to use another HTTP state for it (I've implemented it with the  
 undefined state 491 some month ago).
 But this way requires enabled JavaScript in the users browser and  
 support for the XMLHttpRequest object.

If I understand you correctly, you are suggesting using an  
XMLHttpRequest in order to send a request with an Authorization header  
to perform the login.  That gets around the problem of using Guard to  
do the initial authentication, but how do you prevent the user from  
being prompted on every request?  It seems like you'd still need some  
sort of client-side state and a way to interpret it on the server.

Or do I misunderstand what you are suggesting? Do have a writeup of  
the XMLHttpRequest-based protocol you are using?

Thanks,
Rhett

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989934


Re: securing Restlet

2008-12-22 Thread Stephan Koops
Hi Rhett,

  There is a way, but HTML and HTTP is not enough: You need JavaScript  
  to send a XMLHttpRequest. But you can't use http state 401 for  
  return, because the browser should prompt (search for 401 on 
  http://www.w3.org/TR/XMLHttpRequest/) 
   for the users credentials, and that is, what we don't want. So we  
  hae to use another HTTP state for it (I've implemented it with the  
  undefined state 491 some month ago).
  But this way requires enabled JavaScript in the users browser and  
  support for the XMLHttpRequest object.
 
 If I understand you correctly, you are suggesting using an  
 XMLHttpRequest in order to send a request with an Authorization header  
 to perform the login.  That gets around the problem of using Guard to  
 do the initial authentication, but how do you prevent the user from  
 being prompted on every request?  It seems like you'd still need some  
 sort of client-side state and a way to interpret it on the server.
If you give the credentials to the browser, the browser saves them in memory 
and send it for every request to the same realm on the server, until the 
browser is closed. So you don't need to re-enter them.
This is client state, as you said, but client state is allowed in REST. Only 
application state in the server is forbidden.

 Or do I misunderstand what you are suggesting? Do have a writeup of  
 the XMLHttpRequest-based protocol you are using?
I only set the credentials with the methods for it into the XMLHttpRequest.

best regards
   Stephan
___
Sensationsangebot verlängert: WEB.DE FreeDSL - Telefonanschluss + DSL
für nur 16,37 Euro/mtl.!* http://dsl.web.de/?ac=OM.AD.AD008K15039B7069a

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989958


Re: securing Restlet

2008-12-22 Thread Stephan Koops
Hi Rémi,

cool.
Jerome, Thierry: Could we add it to the code base, if the security is 
refactored?

best regards
   Stephan

 I have made a cookie authentication for restlet.
 
 Here is the code. Few things might not be clean but it works quite 
 fine.
 
 I hope it helps.
 
 Rémi
___
Täglich 1.000.000 Euro gewinnen! Jetzt kostenlos WEB.DE MillionenKlick 
spielen! https://millionenklick.web.de/?mc=m...@footer.mklick@home

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989993


Re: securing Restlet

2008-12-22 Thread Rhett Sutphin
Hi Stephan,

On Dec 22, 2008, at 12:02 PM, Stephan Koops wrote:

 Hi Rhett,

 There is a way, but HTML and HTTP is not enough: You need JavaScript
 to send a XMLHttpRequest. But you can't use http state 401 for
 return, because the browser should prompt (search for 401 on 
 http://www.w3.org/TR/XMLHttpRequest/)
 for the users credentials, and that is, what we don't want. So we
 hae to use another HTTP state for it (I've implemented it with the
 undefined state 491 some month ago).
 But this way requires enabled JavaScript in the users browser and
 support for the XMLHttpRequest object.

 If I understand you correctly, you are suggesting using an
 XMLHttpRequest in order to send a request with an Authorization  
 header
 to perform the login.  That gets around the problem of using Guard to
 do the initial authentication, but how do you prevent the user from
 being prompted on every request?  It seems like you'd still need some
 sort of client-side state and a way to interpret it on the server.
 If you give the credentials to the browser, the browser saves them  
 in memory and send it for every request to the same realm on the  
 server, until the browser is closed. So you don't need to re-enter  
 them.
 This is client state, as you said, but client state is allowed in  
 REST. Only application state in the server is forbidden.

 Or do I misunderstand what you are suggesting? Do have a writeup of
 the XMLHttpRequest-based protocol you are using?
 I only set the credentials with the methods for it into the  
 XMLHttpRequest.

Oh, so when you pass credentials using XmlHttpRequest, the browser  
automatically caches them?  That's cool.  I didn't know that worked.   
I guess this has the same downside as normal browser-based  
authentication, then -- it's impossible to log out without quitting  
the browser.

Thanks,
Rhett

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=990013


Re: securing Restlet

2008-12-22 Thread Rob Heittman
Hi Rhett,

Depending on the browser (I forget which ones exactly) you can sometimes
push empty credentials into an XmlHttpRequest to effectively log out the
user.  But now, we are far down the path of horrible hacks  :-)

The caching of HTTP Basic credentials into XmlHttpRequest is inconsistently
implemented between browsers itself; it's a neat trick, but I don't consider
it production-reliable with unknown clients.  For example, some browsers
will *also* use the pushed credentials for non-XmlHttpRequest operations
(e.g. fetching images), others restrict it only to the XmlHttpRequest object
... g.

- R

On Mon, Dec 22, 2008 at 2:30 PM, Rhett Sutphin rh...@detailedbalance.netwrote:

 Oh, so when you pass credentials using XmlHttpRequest, the browser
 automatically caches them?  That's cool.  I didn't know that worked.
 I guess this has the same downside as normal browser-based
 authentication, then -- it's impossible to log out without quitting
 the browser.


--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=990026

Re: securing Restlet

2008-12-22 Thread Stephan Koops
Hi Rhett,
 Oh, so when you pass credentials using XmlHttpRequest, the browser  
 automatically caches them?  That's cool.  I didn't know that worked.   
 I guess this has the same downside as normal browser-based  
 authentication, then -- it's impossible to log out without quitting  
 the browser.
With a trick you can: If you want to logout, you send a XMLHttpRequest 
(e.g. started via a link, which starts a JavaScript) with standardized 
credentials (e.g.: user: logout, password: logout). The Guard (or 
whatever Filter) filters this user out, and returns a success state. 
Than the browser save the new credentials and send it for further 
requests. So the server must only filter the username logout and 
remove the credentials before processing the request. I've implemented 
this at the end of the last year (Restlet 1.0.6), but with the current 
snapshot it doesn't work. I have to check why, but need time for it ...

best regards
   Stephan

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=990101


question about spring example and uri extension parsing/best practices.

2008-12-22 Thread matt
Hi there

Firstly I love restlet and much thanks to the people who work on it and i have 
been able to get up to speed really quickly.

I have two questions. One is where to find a complete example of the 
spring-restlet integration. I tried the cvs repo on the wiki and for some 
reason could never get there?!?

The next and more important REST and url extension and return format? I am in 
the quandry of deciding to do my rest API via extension or an 'optional' 
argument. I have included a snippit of my spring config below...

i.e.

1) myapi/v1/company/1.xml (or rss, json) bla bla bla

2) a) myapi/v1/company/1 - default xml
 b) myapi/v1/company/1format=xml
 c) myapi/v1/company/1/format=xml
 
2a and 2c works right out of the box so to speak. However 1 and 2b break since 
they pass in 1.xml and 1format=xml in the company {id} param. I would like to 
make my urls at least work for 2b or possibly 1 as well. I was not sure if I 
had to define some special regex in my routes for each pattern or if there was 
a global way to do cush filtering/url munging with restlet. Or if I had to roll 
my own. My end goal is to switch the accepted varient type based on either uri 
extension or optional format=XXX but get some strange behaviour in the routing 
itself.

My same was pulled from the spring sample and works wonderully minus this 
extension parsing issue.

entry key=/company/{id}
bean 
class=org.restlet.ext.spring.SpringFinder
lookup-method 
name=createResource bean=companyResource /
/bean
/entry

// this would work for xml but I do not want to do this for // every extension
entry key=/company/{id}.xml

Thanks in advance..

matt

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=990197


RE: Re: Router class not matching a URI with corresponding Template correctly

2008-12-22 Thread prashantideal
Hi Thierry,

Thank you very much for your response.
Whatever you explained its fine. But problem in my application is, I have to 
write code to match the incoming formatted URI with a template(stored in a 
collection).

I am using Template.match(String) method in my code to match formatted URI with 
a template pattern. 

Now, what this match method is doing it is returning two matches.

E.g.
/language/{var1}/{var2}/
/language/{var1}/{var2}/java/

If i send a request to my application with URI
/language/test/12345/java/

and try to match using Template.match() method, it is returning 

two results.

Code is something like:

Reference URI = request.getResourceRef();
Router router = (Router) getNext();
RouteList list = router.getRoutes();
IteratorRoute itr = list.listIterator();
while(itr.hasNext())
{
  Route route = itr.next();
 route.getTemplate().getDefaultVariable().setType(Variable.TYPE_URI_ALL);

route.getTemplate().setMatchingMode(Template.MODE_EQUALS);

if(route.getTemplate().match(URI.getRemainingPart())!=-1)
{
logger.debug(Match found:);
}
}

The above given code logs Match found: two times for both the URIs.


Thanks
Prashant

 Hello prashant,
 
 you can specify the type of a single variable as follow:
 Route route = router.attach(/language/{var1}/{var2}/, restlet1);
 route.getTemplate().getVariables().put(var1, new 
 Variable(Variable.TYPE_ALPHA));
 
 
 I also send you a sample application that illustrates this.
 
 best regards,
 Thierry Boileau
 
  Hi All,
 
  I am new to Restlets even after working for around last 8 months on 
  restlets. :-)
 
  I am facing a problem with my application.
 
  Description is as follows:
 
  In my application class I have two REST URIs as given below:
 
  (1st) /language/{var1}/{var2}/
  (2nd) /language/{var1}/{var2}/java/
 
  I have also set Default matching mode of the router to MODE_EQUALS.
 
  Now, if I test second URI with not providing value for one of the varibales 
  e.g.
  /language/12345/java/ 
  (Note: value for var1 is missing in this URI)
 
  My Router is matching this URI with first URI template and executes restlet 
  class assgined to first URI i.e /language/{var1}/{var2}/
 
  Ideally if i have set matching mode to MODE_EQUALS for router it should 
  show a message server has not found anything matching requested URI with 
  response code 404.
 
  Please help me coming out of this problem. I have also tries with changin 
  type of default varibale but no luck.
 
  Thanks in advance.
  Prashant
 
  --
  http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=989509
 
 

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447dsMessageId=990414