Imagine this:
1. I'm logged in
2. I try to access xy controller method for which I
don't have necessary rights
@expose()
@require(predicates.has_permission('XY')
def xy(self):
pass
This is what happens:
1. I am redirected to login page
2.a. I'm no longer logged in
2.b. It is hard to get back to previous page (you have to
press the back button several times) - an often impossible
because you are no longer logged in :)
By studying the source code I can make two observations:
1. 401 is used all the time. Shouldn't we be using
403 sometimes? Like in this case...
2. If I'm reading this correctly, the "remember" phase is
skipped because there was an error - this is probably
the reason I'm no longer logged in. It all happens in
repoze.who.middleware after the following line:
if self.challenge_decider(environ, wrapper.status, wrapper.headers):
"else" is not selected and "identifier.remember"
is not executed.
Any ideas how to proceed with this problem?
I must be missing something, or is this one big gaping
flaw in who/what middleware. Imagine if your OS logged
you out if you tried to access a file for which you don't
have a permission.
Regards,
Tvrtko
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"TurboGears" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/turbogears?hl=en
-~----------~----~----~----~------~----~------~--~---
