-----BEGIN PGP SIGNED MESSAGE-----
Joseph Thomas (s) wrote:
> I think I get what you're suggesting, but let me clarify.
> I actually wanted the sensitive portions of URL to be
> encrypted..because it will be link on a page that says "login to
> zope"..but I wouldn't want the user or a snooper to be able to view
> the page source and figure out the URL pattern and the
> SSL will ensure that the transport between the browser and the zope
> server will be encrypted using PKI, but I really want to obfuscate
> the user name and password parameters in the login URL. So that that
> if some1 where to view the source they'd see garbled
> username/password parameters.
> I suppose I could use the PKI to encrypt the username/password with
> my zope server's public key (but is there a API to do this on a J2EE
> container) and then have my zope server decrypt using its private key
> (but how would zope know that the username/password parameters are 2
> be treated as encrypted data)?
On the Zope side, write a PAS plugin which knows how to extract the
URL-based credentials, decrypting them as appropriate. You could
prototype this as a ScriptablePlugin containing an ExternalMethod named
'extractCredentials' (might even be good enough for production, depending).
Tres Seaver +1 540-429-0999 tsea...@palladion.com
Palladion Software "Excellence by Design" http://palladion.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
Zope maillist - Zope@zope.org
** No cross posts or HTML encoding! **
(Related lists -