Well, not only is the remember phase skipped, the challenge
function explicitly forgets the identity. I'm not sure how to
solve this without modifying repoze.who.
I modified it in the following ways (all changes are to
PluggableAuthenticationMiddleware class):
1. Don't forget identities in challenge()
2. Don't consider pre-authenticated identities as
best, do the opposite
I now have the system working as desired.
Any thoughts? Am I doing something nonsecure?
As a sidenote: I looked up the 403 code which I
thought might help repoze.who decide how to behave
(forget or not), but I found this:
However, the HTTP specification states that
403 should only be used when authorization
will not help.
Regards,
Tvrtko
On 15 velj, 04:22, Tvrtko <[email protected]> wrote:
> Imagine this:
>
> 1. I'm logged in
> 2. I try to access xy controller method for which I
> don't have necessary rights
>
> @expose()
> @require(predicates.has_permission('XY')
> def xy(self):
> pass
>
> This is what happens:
>
> 1. I am redirected to login page
> 2.a. I'm no longer logged in
> 2.b. It is hard to get back to previous page (you have to
> press the back button several times) - an often impossible
> because you are no longer logged in :)
>
> By studying the source code I can make two observations:
> 1. 401 is used all the time. Shouldn't we be using
> 403 sometimes? Like in this case...
> 2. If I'm reading this correctly, the "remember" phase is
> skipped because there was an error - this is probably
> the reason I'm no longer logged in. It all happens in
> repoze.who.middleware after the following line:
>
> if self.challenge_decider(environ, wrapper.status, wrapper.headers):
>
> "else" is not selected and "identifier.remember"
> is not executed.
>
> Any ideas how to proceed with this problem?
>
> I must be missing something, or is this one big gaping
> flaw in who/what middleware. Imagine if your OS logged
> you out if you tried to access a file for which you don't
> have a permission.
>
> Regards,
> Tvrtko
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"TurboGears" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/turbogears?hl=en
-~----------~----~----~----~------~----~------~--~---
