Re: how to write our own handler to handle login in cherryPY

Like Tim said: "basic authentication" is a specific thing. What you're
doing is not it. But you COULD use basic auth to do this kind of login:
look at the auth_basic tool:
https://cherrypy.readthedocs.org/en/3.3.0/refman/lib/auth_basic.html

You have to construct your REST calls to include the authentication header
on every request. This is the easiest way to REST.

Alternatively, as Michael suggested, you can use the built in
authentication handler to log in, and return a session cookie, but that
session cookie must be used on every subsequent request.

Thirdly, you can create a new authentication handler/tool that does exactly
what you want it to. Personally, I like to pre-generate random keys for
REST API users and use that to generate session tokens that are used for
subsequent calls. That works well if the user of the API is not a person,
but a process.

I'm waving my hands a bit here, because REST authentication is not
standardized. But reading the cherrypy code for both the "session_auth" and
"auth_basic" tools should give you a good idea of where you should take it.

Depending on the complexity of your API, you should probably look into
implementing OAuth 2.0 for not just authentication, but authorization as
well. If REST is standardizing on something, this is it. There are third
party tools for this (in fact some of the pypi available oauth provider
libraries provide cherrypy tools for this). OAuth also lets you delegate
authentication to Google, or Facebook so that users have fewer credentials
to remember.

Finally, make sure you're using SSL/TLS for any of these mechanism because
intercepting the session token, the username/password, or the
authentication token means unfettered access. It's required for OAuth, but
not enforced for everything else, so be careful.

Joseph

On Tue, Apr 26, 2016 at 7:06 AM Dharmendra Shaw <[email protected]>
wrote:

> I am using cherrypy for my web app for authentication we are using
>  "tools.session_auth.login_screen " and
>  "tools.session_auth.check_username_and_password" handlers for login
> authentication
>  Now I have a need to support  login  to app using REST api call something
> like below url using basic authentication call from another app
> login?username=username&password=test
>
>
>
> On Tuesday, 26 April 2016 08:56:12 UTC+5:30, Joseph Tate wrote:
>
>> I don't know what you're asking. What have you tried? What authentication
>> type are you trying to use? What doesn't work?
>>
>> On Mon, Apr 25, 2016 at 7:22 AM Dharmendra Shaw <[email protected]>
>> wrote:
>>
> how to write our own handler to handle login in cherryPY  framwork,
>>> Currently with default handler I am not able to login using remote Rest API
>>> call
>>>
>>> --
>>> You received this message because you are subscribed to the Google
>>> Groups "cherrypy-users" group.
>>>
>> To unsubscribe from this group and stop receiving emails from it, send an
>>> email to cherrypy-user...-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
>>> To post to this group, send email to cherryp...-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
>>
>>
>>> Visit this group at https://groups.google.com/group/cherrypy-users.
>>> For more options, visit https://groups.google.com/d/optout.
>>>
>> --
> You received this message because you are subscribed to the Google Groups
> "cherrypy-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
> To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
> Visit this group at https://groups.google.com/group/cherrypy-users.
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups "cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
Visit this group at https://groups.google.com/group/cherrypy-users.
For more options, visit https://groups.google.com/d/optout.