Controlling REST access for anonymous

Hi all:

Does a mechanism exist to prevent the xmlrpc and rest api's from being
used by the anonymous user?

I thought there was a way to prevent the anonymous user from using the
web interface. I thought it was separate from setting up schema
permisions to deny anonymous access to all database objects. However,
a quick doc search isn't confirming my memory.

At the moment, the tx_Source (transaction source) parameter for all
web based access (rest, xmlrpc, web) is set to web. Do we need:

   tx_Source = "web" : html based interface

with
   tx_Source = ("web", "rest")  (tuple to allow "rest" or "web" in tx_Source)
 or
   tx_source = "web:rest"    : string to allow tx_source.startswith("web")
                               or tx_source = "web:rest"
and:

   tx_Source = ("web", "xmlrpc")
 or
   tx_source = "web:xmlrpc"    : for the xmlrpc interface

values to allow schema permissions to differentiate among the
mechanisms?

The rate limiting code I am working on triggered this question. Rate
limits are per user. In theory there is only one user who can log in
as rouilj. However there can be an unlimited number of people/bots
that can use the anonymous user. There is no rate limit on the web
(http/html) interface so this isn't a problem for anonymous use of the
web interface.

In this context I think there is value in differentiating access to
html vs rest vs xmlrpc? From a technical point of view because of rate
limits, abuse via http/html is not the same as via rest. Maybe this
means the simple minded one rate limit for all users needs to be
rethought?

Quips, comments, evasions, questions and answers welcome. I kind of
feel like I am working in a vacuum here.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.