Comments on: RPC and Authentication http://www.davidfischer.name/2009/09/rpc-and-authentication/ Some Things to Some People Thu, 02 Sep 2010 05:29:07 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: David http://www.davidfischer.name/2009/09/rpc-and-authentication/comment-page-1/#comment-51 David Fri, 02 Oct 2009 05:58:21 +0000 http://www.davidfischer.name/?p=239#comment-51 I'm leaning toward using the <a href="http://docs.djangoproject.com/en/1.1/howto/auth-remote-user/" rel="nofollow">RemoteUserMiddleware</a>, but that means making the authentication only compatible with Django 1.1+. However, this makes a lot of sense given that I'm using a server based authentication system. If in the future, I decide to support a session based authentication system, hopefully I can use a different middleware for that. I’m leaning toward using the RemoteUserMiddleware, but that means making the authentication only compatible with Django 1.1+. However, this makes a lot of sense given that I’m using a server based authentication system. If in the future, I decide to support a session based authentication system, hopefully I can use a different middleware for that.

]]> By: David http://www.davidfischer.name/2009/09/rpc-and-authentication/comment-page-1/#comment-46 David Mon, 21 Sep 2009 16:08:09 +0000 http://www.davidfischer.name/?p=239#comment-46 <a href="#comment-45" rel="nofollow">@aaloy </a> This same type of authentication is supported by XMLRPC clients in at least <a href="http://ws.apache.org/xmlrpc/client.html" rel="nofollow">Java</a> and <a href="http://phpxmlrpc.sourceforge.net/doc-2/ch07s03.html" rel="nofollow">PHP</a> and you are using it in Javascript. In addition, if the RPC client is on the same port, domain and protocol as the rest of your website, then once a user is authenticated in a browser session, all future requests for that session will contain the authentication information. This is why the simple Javascript JSONRPC client on the demo site's method summary page still works. This is nice because you don't even have to use a fancy Javascript library like qooxdoo. Just <a href="http://docs.djangoproject.com/en/dev/howto/apache-auth/" rel="nofollow">tie your Apache authentication to your Django user database</a> and you're done! There really isn't a whole lot of work to be done to add this authentication so I think I can handle it. However, I am always willing to accept a patch if you contribute something. @aaloy
This same type of authentication is supported by XMLRPC clients in at least Java and PHP and you are using it in Javascript. In addition, if the RPC client is on the same port, domain and protocol as the rest of your website, then once a user is authenticated in a browser session, all future requests for that session will contain the authentication information. This is why the simple Javascript JSONRPC client on the demo site’s method summary page still works. This is nice because you don’t even have to use a fancy Javascript library like qooxdoo. Just tie your Apache authentication to your Django user database and you’re done!

There really isn’t a whole lot of work to be done to add this authentication so I think I can handle it. However, I am always willing to accept a patch if you contribute something.

]]> By: aaloy http://www.davidfischer.name/2009/09/rpc-and-authentication/comment-page-1/#comment-45 aaloy Mon, 21 Sep 2009 10:33:37 +0000 http://www.davidfischer.name/?p=239#comment-45 I like this approach, in fact Qooxdoo people in their API also suposes this kind of authentication, see: http://demo.qooxdoo.org/current/apiviewer/#qx.io.remote.Rpc To be consistent with Django I agree with you that user authentication should come in the HTTP header. The only risk I see in this is to be able to comunicate with non Python clients (Qooxdoo for me) and not make it just Python based. Please let me know if I can help in any way. I like this approach, in fact Qooxdoo people in their API also suposes this kind of authentication, see: http://demo.qooxdoo.org/current/apiviewer/#qx.io.remote.Rpc

To be consistent with Django I agree with you that user authentication should come in the HTTP header. The only risk I see in this is to be able to comunicate with non Python clients (Qooxdoo for me) and not make it just Python based.

Please let me know if I can help in any way.

]]>