On Feb 25, 11:28 pm, Jorge Vargas <[email protected]> wrote: > On Wed, Feb 25, 2009 at 10:22 AM, Ben Sizer <[email protected]> wrote: > > I'm sorry if this sounds a little out of tone, but if you will have > spend the time you did making all this elaboration reading up the > source a little and finding out what it actually does you will have > understand that half what you are saying is totally off and > misleading.
Jorge, as far as I know I'm just repeating what has been said above. Could you explain where I'm wrong? The chances of me being able to follow the source sufficiently are minimal, hence asking the questions here where experts such as yourself can correct or inform me far more easily. > second this is all configurable so you are complaining about a feature > you can turn off. Simply edit your app_cfg.py to remove the cookie > plugin. I would guess that makes any sort of session impossible, right? > 4th, any of the webapps you suggested works the same way, there is a > cookie with the auth info, it is what allows the "remember me" > functionality and any sane app will ONLY store authentication > information here, otherwise you have a HUGE hole as a user could just > modify his cookie to get himself root access to the app. I admit I am not 100% sure of the details and the differences but Mark said above that "we're setting a session cookie that says you're authorized". I took this to mean there is a reference in the cookie to some authorization data on the server. -- Ben Sizer --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
