Re: how to write our own handler to handle login in cherryPY

My configuration is as below 

tools.sessions.on = True
tools.session_auth.on = True
tools.session_auth.on_login = mytool.web.authentication.on_login
tools.session_auth.on_logout = mytool..web.authentication.on_logout
tools.session_auth.login_screen = mytool..web.authentication.login_screen
tools.session_auth.check_username_and_password 
= mytool..web.authentication.check_username_and_password

login_screen here returns a html form with action as "do_login" , then It 
gets handled by cherry handler ,
is It possible to differentiate  in method login_screen a browser or native 
client call and if call is from browser it should return the html Form page 
else if the call is from Native client then It would read the user 
credential from hear , the native application here is a .net application 
and tries to login to mTool  remotely by providing user credentials 


On Wednesday, 27 April 2016 00:24:15 UTC+5:30, Joseph Tate wrote:
>
> Like Tim said: "basic authentication" is a specific thing. What you're 
> doing is not it. But you COULD use basic auth to do this kind of login: 
> look at the auth_basic tool: 
> https://cherrypy.readthedocs.org/en/3.3.0/refman/lib/auth_basic.html
>
> You have to construct your REST calls to include the authentication header 
> on every request. This is the easiest way to REST.
>
> Alternatively, as Michael suggested, you can use the built in 
> authentication handler to log in, and return a session cookie, but that 
> session cookie must be used on every subsequent request.
>
> Thirdly, you can create a new authentication handler/tool that does 
> exactly what you want it to. Personally, I like to pre-generate random 
> keys for REST API users and use that to generate session tokens that are 
> used for subsequent calls. That works well if the user of the API is not a 
> person, but a process.
>
> I'm waving my hands a bit here, because REST authentication is not 
> standardized. But reading the cherrypy code for both the "session_auth" and 
> "auth_basic" tools should give you a good idea of where you should take it.
>
> Depending on the complexity of your API, you should probably look into 
> implementing OAuth 2.0 for not just authentication, but authorization as 
> well. If REST is standardizing on something, this is it. There are third 
> party tools for this (in fact some of the pypi available oauth provider 
> libraries provide cherrypy tools for this). OAuth also lets you delegate 
> authentication to Google, or Facebook so that users have fewer credentials 
> to remember.
>
> Finally, make sure you're using SSL/TLS for any of these mechanism because 
> intercepting the session token, the username/password, or the 
> authentication token means unfettered access. It's required for OAuth, but 
> not enforced for everything else, so be careful.
>
> Joseph
>
> On Tue, Apr 26, 2016 at 7:06 AM Dharmendra Shaw <[email protected] 
> <javascript:>> wrote:
>
>> I am using cherrypy for my web app for authentication we are using 
>>  "tools.session_auth.login_screen " and 
>>  "tools.session_auth.check_username_and_password" handlers for login 
>> authentication
>>  Now I have a need to support  login  to app using REST api call 
>> something like below url using basic authentication call from another app   
>>   login?username=username&password=test 
>>
>>  
>>
>> On Tuesday, 26 April 2016 08:56:12 UTC+5:30, Joseph Tate wrote:
>>
>>> I don't know what you're asking. What have you tried? What 
>>> authentication type are you trying to use? What doesn't work?
>>>
>>> On Mon, Apr 25, 2016 at 7:22 AM Dharmendra Shaw <[email protected]> 
>>> wrote:
>>>
>> how to write our own handler to handle login in cherryPY  framwork, 
>>>> Currently with default handler I am not able to login using remote Rest API 
>>>> call  
>>>>
>>>> -- 
>>>> You received this message because you are subscribed to the Google 
>>>> Groups "cherrypy-users" group.
>>>>
>>> To unsubscribe from this group and stop receiving emails from it, send 
>>>> an email to cherrypy-user...-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
>>>> To post to this group, send email to cherryp...-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
>>>
>>>
>>>> Visit this group at https://groups.google.com/group/cherrypy-users.
>>>> For more options, visit https://groups.google.com/d/optout.
>>>>
>>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "cherrypy-users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to cherrypy-user...-/[email protected] <javascript:>.
>> To post to this group, send email to cherryp...-/[email protected] 
>> <javascript:>.
>> Visit this group at https://groups.google.com/group/cherrypy-users.
>> For more options, visit https://groups.google.com/d/optout.
>>
>

-- 
You received this message because you are subscribed to the Google Groups "cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
Visit this group at https://groups.google.com/group/cherrypy-users.
For more options, visit https://groups.google.com/d/optout.