restful-authentication | 易学教程

What is the correct way of find out if user is logged in in MVC WEB API?

阅读更多关于 What is the correct way of find out if user is logged in in MVC WEB API?

I am very confused about this problem. Restfull service make it up to you to decide which way to implement this functionallity. Ive read multiple articles about this problem, but every article says something different. For example some people propopse sessions, but if you do that Web api is losing its "rest fullness". Other people suggest cockies. I dont know if what i am done is actually done right: On login of user i create a cockie which contains UserID(Guid) and on every request which needs user to be logged in i check if this id exsists in the DB. Is it secure enough? Or how should i make

Securing RESTapi in flask

阅读更多关于 Securing RESTapi in flask

问题 The app I'm deving uses a lot of ajax calls. Unfortunately I hit a snag when researching on how to restrict access to the api. For example: i have table that does an ajax call to http://site/api/tasks/bob i need to make sure that only bob, logged in, can read that table (otherwise somebody who knows the pattern might request to see bob's tasks by simply entering the url in the browser). on a different page,the same table needs to be able to call http://site/api/tasks/all and show the tasks of

REST authentication and HMAC/private key (when do I set it?)

阅读更多关于 REST authentication and HMAC/private key (when do I set it?)

问题 I've been toying around with a simple application idea the last couple of days as I'm trying to teach myself the basic of REST authentication. So far I've gathered that the best way to do this is with an implementation of HMAC like the one used by Amazon. My biggest concern is with exactly how am I suppose to authenticate the user and give them their private key so they can begin signing the HMAC? I keep reading that the private key used for signing the HMAC is not supposed to be sent over

RESTful user authentication service

阅读更多关于 RESTful user authentication service

Hey folks, this seems to have been discussion fairly often but I want to make a simple, watered down question around doing authentication with RESTful services. The scenario is as follows: There is a system that houses registered users for an application. The system exposes a RESTful API for accessing these users. There is a front-end application that has a login form. The application can either be internal, or external. The front-end application needs to use the data in the User system to authenticate a user. The question now is how to authenticate a user whose credentials (username/password)

HTTP 401 Unauthorized or 403 Forbidden for a “disabled” user?

阅读更多关于 HTTP 401 Unauthorized or 403 Forbidden for a “disabled” user?

问题 An authentication service allows user accounts be disabled (a sort of soft-delete). If the server then receives an authentication request for a disabled user that would otherwise be valid, should the server return 401 or 403? With either status code, I would return a message indicating that the account had been disabled. For quick reference, relevant quotes from HTTP/1.1 spec (emphasis mine): 401 Unauthorized The request requires user authentication. The response MUST include a WWW

Recommended configuration for both web client and mobile REST api security

阅读更多关于 Recommended configuration for both web client and mobile REST api security

I realize there are a ton of questions on this subject, and I have been researching this for a couple days now. I want to make sure my question is as specific as possible since I have yet to gain a full understanding of the best approach. Currently I have a developed django site, with the web client communicating probably about 95% via a django-piston json REST api. The other 5% is some remaning login functionality that still goes through POST forms with CSRF protection. Ideally I would like to move the remainder also into the REST api. I am at the point now where I need to figure out the best

How to do Rest Authentication with JAX-RS

阅读更多关于 How to do Rest Authentication with JAX-RS

I am looking for some pointers on how to secure my rest root resource @Path("/employee") public class EmployeeResource { @GET @Produces("text/html") public String get( @QueryParam("name") String empname, @QueryParam("sn") String sn) { // Return a data back. } } I have read post's regarding basic authetication and OAuth, I know the concept but i am looking for ways on how to implement it in code. Thanks Declare an interceptor: <bean id="securityInterceptor" class="AuthenticatorInterceptor"> <property name="users"> <map> <entry key="someuser" value="somepassword"/> </map> </property> Then use it

Combining Flask-restless, Flask-security and regular Python requests

阅读更多关于 Combining Flask-restless, Flask-security and regular Python requests

问题 My goal is to provide a REST API to my web application. Using: Python 2.7.5 Flask==0.10.1 Flask-Restless==0.13.1 Flask-Security==1.7.3 I need to secure access to my data for both web and REST access. However, I am unable to get any regular python request succeeding when trying to connect to secured API. The following outputs are obtained using the fully-functional module provided at the end of this question. I manage to get a correct answer when using http://127.0.0.1:5000/api/v1/free_stuff :

Exposing Rails/Devise Authentication to iOS application

阅读更多关于 Exposing Rails/Devise Authentication to iOS application

问题 I have a rails 3.1 application that uses Devise for Authentication with a simple User model with email,password etc. I need to be able to authenticate from an iphone application. How do I expose this functionality? Broad answers are fine as I am not sure what my options are. 回答1: The fastest way would be to simply enable http_authenticatable and pass the username and password through HTTP Basic Auth. While that's the easiest way, it means you have to store the users password in plaintext and

What does #self.included(base) do in Ruby on Rails' Restful Authentication?

阅读更多关于 What does #self.included(base) do in Ruby on Rails' Restful Authentication?

问题 I thought we would do helper_method :current_user, :logged_in?, :authorized? to make these controller methods available for use as helper methods in views. But in Restful Authentication's lib/authenticated_system.rb , I see: # Inclusion hook to make #current_user and #logged_in? # available as ActionView helper methods. def self.included(base) base.send :helper_method, :current_user, :logged_in?, :authorized? if base.respond_to? :helper_method end Why is it done this way instead of that