Re: How to make REMOTE_USER variable private across WSGI middlewares?

Randy Syring <randy-+PLZm/s06Zpa7S/[email protected]> Tue, 11 Oct 2016 19:44:56 -0400
Newsgroups gmane.comp.python.web
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--===============1130978730852735422==
Content-Type: multipart/alternative;
 boundary="------------DFBD501C83F27CDE843840E6"

This is a multi-part message in MIME format.
--------------DFBD501C83F27CDE843840E6
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit

I think this is not the best mailing list to ask a question like this.  
You are probably better served to ask on Stack Overflow or some other 
place with more activity.

For what it's worth, I also think you might misunderstand how WSGI 
works.  I believe the environment object is supposed to exist in a 
request context.  I'm assuming you only need one user per request, so 
simply filling in the value of REMOTE_USER seems to me like it should 
work.  However, I haven't looked at your code or thought long about the 
problem, it's just an off-handed observation based on your description 
below.

*Randy Syring*
Husband | Father | Redeemed Sinner

/"For what does it profit a man to gain the whole world
and forfeit his soul?" (Mark 8:36 ESV)/

On 10/11/2016 06:47 PM, Etienne Robillard wrote:
> Here's the source code: 
> https://bitbucket.org/tkadm30/django-hotsauce/src/6a862e22e045cb10a84f3b08e4c237ed592ecec7/lib/notmm/controllers/wsgi.pyx
>
> A live demo is here: http://www.isotopesoftware.ca/
>
> The problem is in the init_request method.
>
> The current implementation uses threading.local.
>
> I have no idea how to make the WSGI environ object a thread-local in 
> case the remote user has been logged in.
>
>
> Any input would be greatly appreciated.
>
> Regards,
>
> Etienne
>
>
> Le 2016-10-10 à 10:30, Etienne Robillard a écrit :
>> Hi,
>>
>> I'm attempting to develop a OAuth 2.0 authentication middleware which 
>> sets REMOTE_USER variable into the WSGI environ object, however I'm 
>> unable to make this variable unique for the logged user.
>>
>> Is it recommended to use threading.local or gevent to make the WSGI 
>> environment persisting on a per-request basis ?
>>
>> What others options can you advise to make private request data not 
>> accessible in WSGI ?
>>
>> Thanks in advance,
>>
>> Etienne
>>
>>
>


--------------DFBD501C83F27CDE843840E6
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    I think this is not the best mailing list to ask a question like
    this.  You are probably better served to ask on Stack Overflow or
    some other place with more activity.<br>
    <br>
    For what it's worth, I also think you might misunderstand how WSGI
    works.  I believe the environment object is supposed to exist in a
    request context.  I'm assuming you only need one user per request,
    so simply filling in the value of REMOTE_USER seems to me like it
    should wor<font size="+1">k.  However, I haven't looked at your code
      or thought long about the problem, it's just an off-handed
      observation based on your description below.</font><br>
    <div class="moz-signature"><br>
      <b>Randy Syring</b><br>
      <small>Husband | Father | Redeemed Sinner</small><br>
      <br>
      <i><small>"For what does it profit a man to gain the whole world<br>
          and forfeit his soul?" (Mark 8:36 ESV)</small></i>
      <br>
      <br>
    </div>
    <div class="moz-cite-prefix">On 10/11/2016 06:47 PM, Etienne
      Robillard wrote:<br>
    </div>
    <blockquote
      cite="mid:c0b081b1-f18f-3ebb-f9f9-e13393c8ec2e-zJpx2rpV7r/[email protected]"
      type="cite">Here's the source code:
<a class="moz-txt-link-freetext" href="https://bitbucket.org/tkadm30/django-hotsauce/src/6a862e22e045cb10a84f3b08e4c237ed592ecec7/lib/notmm/controllers/wsgi.pyx">https://bitbucket.org/tkadm30/django-hotsauce/src/6a862e22e045cb10a84f3b08e4c237ed592ecec7/lib/notmm/controllers/wsgi.pyx</a><br>
      <br>
      A live demo is here: <a class="moz-txt-link-freetext" href="http://www.isotopesoftware.ca/">http://www.isotopesoftware.ca/</a>
      <br>
      <br>
      The problem is in the init_request method.
      <br>
      <br>
      The current implementation uses threading.local.
      <br>
      <br>
      I have no idea how to make the WSGI environ object a thread-local
      in case the remote user has been logged in.
      <br>
      <br>
      <br>
      Any input would be greatly appreciated.
      <br>
      <br>
      Regards,
      <br>
      <br>
      Etienne
      <br>
      <br>
      <br>
      Le 2016-10-10 à 10:30, Etienne Robillard a écrit :
      <br>
      <blockquote type="cite">Hi,
        <br>
        <br>
        I'm attempting to develop a OAuth 2.0 authentication middleware
        which sets REMOTE_USER variable into the WSGI environ object,
        however I'm unable to make this variable unique for the logged
        user.
        <br>
        <br>
        Is it recommended to use threading.local or gevent to make the
        WSGI environment persisting on a per-request basis ?
        <br>
        <br>
        What others options can you advise to make private request data
        not accessible in WSGI ?
        <br>
        <br>
        Thanks in advance,
        <br>
        <br>
        Etienne
        <br>
        <br>
        <br>
      </blockquote>
      <br>
    </blockquote>
    <br>
  </body>
</html>

--------------DFBD501C83F27CDE843840E6--

--===============1130978730852735422==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Web-SIG mailing list
[email protected]
Web SIG: http://www.python.org/sigs/web-sig
Unsubscribe: https://mail.python.org/mailman/options/web-sig/gcpw-web-sig%40m.gmane.org

--===============1130978730852735422==--