On Saturday February 21, 2009 17:13:53 Florent Aide wrote: > We should just propose an application pattern on the "remove-user" > operation to remove the session from the beaker cache so that the > cookie even if still present on the user's machine is not considered > as a valid token anymore.
Still that wouldn't change the current behavior. repoze.who identifiers don't depend on/use the Beaker cache. When the repoze.who identifier finds a session cookie (which is encrypted), it will extract the username. Then it will take the user name and will use it as the repoze.who.userid -- by doing this, it will bypass the authenticator, but not the MD providers. This is why I proposed to deal with this in a MD provider. On a side note, it's worth noting that if your database is properly set up, when you delete a user, all the rows in the intermediary user/group table will go away too. Therefore, if you delete a user but she keeps a valid cookie session, she will continue logged in, but will have no groups or permissions. Cheers. -- Gustavo Narea <http://gustavonarea.net/>. Get rid of unethical constraints! Get freedomware: http://www.getgnulinux.org/ --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
