On Sep 30, 6:32 pm, "Uwe C. Schroeder" <[EMAIL PROTECTED]> wrote:
> Here is my code that works just fine. It's used for emails (newsletter) sent
> out to users and
> I put a URL in it so the user can log in without typing a password.
> So when generating the mail, I create a key which I store in the database
> along with the user's name
A favorite technique of mine for situations like these is to append a
HMAC of the url as an extra query parameter, and then trust the other
parameters of the URL for any request where the HMAC is valid. This
means that I don't have to store anything in the database, so there is
nothing to expire and clean up or anything.
Pseudo code for generating the link would be:
url.addParameter("user", username)
hmac = hash(secret + url)
url.addParameter("auth-code", hmac)
And for checking:
given_hmac=url.getParameter("auth-code")
url.removeParameter("auth-code")
computed_hmac=hash(secret + url)
if given_hmac==computed_hmac:
set_identity(url.getParameter("user"))
Since you know that it was you who generated the URL if the HMAC
matches, you can trust any info in it. So if you e.g. want to expire
links, you can put an expiry date as a parameter in plain text and
still know that no-one can manipulate it.
Regards
Magnus Reftel
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"TurboGears" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/turbogears?hl=en
-~----------~----~----~----~------~----~------~--~---
