Re: Redirect GET to POST

Not sure if you figured this out yet, but you could probably quickly write
a proxy using the requests module to do this, but you won't get the cookies
right. In short, CherryPy (nor nginx) can handle GET to POST redirects as
far as I know. You might be able to coerce InternalRedirect to do what you
want, or call the POST class method directly from the GET handler (all
handlers in cherrypy are just methods after all and none of the default
decorators directly modify the response object).

I haven't read the OAuth spec for this specific use case, but it doesn't
pass my smell test. Seems like there should be 1) an optimization when
there's no third party to authenticate against so that your POST happens
one step earlier, or 2) there be no requirement to use OAuth since you're
not doing a three way handshake. Facebook doesn't redirect you to a third
party at all to log in, neither does github. Launchpad does, but that's
because it's a separate website/service, and poorly implemented IMHO.

In any case, good luck, and I'd be interested to know what you figure out.

Joseph


On Wed, Jun 14, 2017 at 8:16 AM Aaron Dalton <[email protected]>
wrote:

> Let's get back to my initial question:
>
> Using MethodDispatcher, is it possible in a GET handler to redirect to a
> POST handler? I'm assuming it is not, given that nobody has said either way.
>
> Based on that, then yes, I will have to find another solution, likely
> involving creating a different endpoint for this one case and refactoring
> some of the code to avoid duplication.
>
> To answer your question, the POST in this case is necessary because the
> user needs to see what specific permissions the client is requesting and
> have the opportunity to back out or adjust those before approving the token.
>
> - User clicks Log In button in whatever client (GET to initial oauth
> endpoint, which establishes a session and redirects to the main login page)
> - User logs in (using password, Google, Facebook, whatever) (ultimately a
> POST to the core auth endpoint, though in a roundabout way if logging in
> with Google or something)
> - User redirected to a page providing details on the client requesting
> access, what permissions they're requesting, and whatever other
> instructions they need to understand what's happening (GET to the
> authorization endpoint)
>   - This is the step I want to skip if it's the official client trying to
> log in.
> - User makes final decision as to the permissions to grant (POST to
> authorization endpoint)
> - User is redirected to the authorized return URL with the token
>
>
> On Tuesday, 13 June 2017 15:53:14 UTC-6, Joseph Tate wrote:
>>
>> Then don't you just redirect back to the return url? That's not your job
>> to post that data as the authenticating agency. Your app that is the
>> recipient of the redirect can issue auth tokens on a GET. That's not
>> something that requires a POST.
>>
>>
>>> --
> You received this message because you are subscribed to the Google Groups
> "cherrypy-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
> To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
> Visit this group at https://groups.google.com/group/cherrypy-users.
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups "cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
Visit this group at https://groups.google.com/group/cherrypy-users.
For more options, visit https://groups.google.com/d/optout.