> Thus, while permission checks can be cached, the caching (and it's > lifetime) should only be done explicitly by the developer of the > application, and never automatically by the framework. > > > Am I understanding the way repoze is working correctly?
Well, it's not so much that we're caching the authorization, as that we're setting a session cookie that says you're authorized when you do the auth. And then just checking for info from the cookie on subsequent connections. So you're only authenticated for as long as that browsing session lasts. The impact of the fact that some users keep sessions open for a very long time could be mitigated by setting a relatively short expire time on the cookie too. But this is by no means a TG2 specific issue, but is the case for any framework that doesn't re-check the authentication info on every single request, and as far as I know that includes most frameworks. --Mark --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
