On Feb 21, 4:13 pm, Florent Aide <[email protected]> wrote: > On Sat, Feb 21, 2009 at 4:47 PM, Gustavo Narea <[email protected]> wrote: > > Verification on each request will just make auth unscalable... It was > one of our issues in TG1.
I find this hard to believe, because: a) many small to medium sites, typically based on ASP or PHP, already do exactly that; b) you typically just end up duplicating this information in the controller. How often in practice do you lock access to a given resource based on requiring the client to be logged in, and then not require any information at all from the corresponding User object? Hardly ever. So the database hit is there anyway. > We should just propose an application pattern on the "remove-user" > operation to remove the session from the beaker cache so that the > cookie even if still present on the user's machine is not considered > as a valid token anymore. I don't think that is practical in the event where Users are managed externally. -- Ben Sizer --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
