I am aware that REST has come up quite often already on this list, but all current posts seem to miss out on one point: Authentication and Authorisation. Now, this is already quite (IMO) excellently using the Turbogears identity framework. Would it not be nice to be able to use this with RESTful services as well?
I just started exposing specific resource of my application using a REST filter for cherrypy. But I need auth&auth. GETing the resources wont require auth&auth, put POSTing, PUTing and DELETEing would require it. However, turbogears identity will show a HTML based login- form instead of using HTTP auth. This violates the REST princible and is net really usable. To solve this problem until I filnd a better solution I also used a cherrypy filter to do auth. I attached the auth and rest filters to a sub-controller (http://my_domain/rest) which contains one more controller for each resources. It's not perfect, URL-wise, but it's working. Is there any work going on to get REST working in a similar manner (with auth&auth using tg.identity)? Or am I on my own here? Having the cherrypy filters at hand is an extremey powerful tool, but..... is there a way to - maybe - detect any identity decorators that may have been "wrapped" around a controller method from *whithin* the filter? Essentially using the available TG-framework boilerplate to roll my own cherrypy filter to do rest with auth&auth? --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
