On Feb 26, 12:55 pm, Mark Ramm <[email protected]> wrote: > > I admit I am not 100% sure of the details and the differences but Mark > > said above that "we're setting a session cookie that says you're > > authorized". I took this to mean there is a reference in the cookie to > > some authorization data on the server. > > The cookie is an authentication token, nothing more. It's not > authorization to use any resource, it's just something that "proves" > you are the one who logged in earlier. Authorization data stored on > the server can be tied to this token, so that it knows that user x is > connected to this tolken. But the token itself should not be > considered authorization to do anything.
Ok, this is looking like a confusion over terminology. You said "we're setting a session cookie that says you're authorized when you do the auth." That really looks to me like the session contains authorization info, that can presumably outlast the rows in the database that the authorization was originally based on. The cookie is only authentication, but it "says you're authorized". I hope you can see where my confusion would come in, based on the above? I'm not trying to split hairs, just really trying to understand why this is not clear. -- Ben Sizer --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
