> I admit I am not 100% sure of the details and the differences but Mark > said above that "we're setting a session cookie that says you're > authorized". I took this to mean there is a reference in the cookie to > some authorization data on the server.
The cookie is an authentication token, nothing more. It's not authorization to use any resource, it's just something that "proves" you are the one who logged in earlier. Authorization data stored on the server can be tied to this token, so that it knows that user x is connected to this tolken. But the token itself should not be considered authorization to do anything. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
