Re: How to make REMOTE_USER variable private across WSGI middlewares?
Randy Syring <randy-+PLZm/s06Zpa7S/[email protected]> Tue, 11 Oct 2016 19:44:56 -0400
| Newsgroups | gmane.comp.python.web |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1130978730852735422==
Content-Type: multipart/alternative;
boundary="------------DFBD501C83F27CDE843840E6"
This is a multi-part message in MIME format.
--------------DFBD501C83F27CDE843840E6
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
I think this is not the best mailing list to ask a question like this.
You are probably better served to ask on Stack Overflow or some other
place with more activity.
For what it's worth, I also think you might misunderstand how WSGI
works. I believe the environment object is supposed to exist in a
request context. I'm assuming you only need one user per request, so
simply filling in the value of REMOTE_USER seems to me like it should
work. However, I haven't looked at your code or thought long about the
problem, it's just an off-handed observation based on your description
below.
*Randy Syring*
Husband | Father | Redeemed Sinner
/"For what does it profit a man to gain the whole world
and forfeit his soul?" (Mark 8:36 ESV)/
On 10/11/2016 06:47 PM, Etienne Robillard wrote:
> Here's the source code:
> https://bitbucket.org/tkadm30/django-hotsauce/src/6a862e22e045cb10a84f3b08e4c237ed592ecec7/lib/notmm/controllers/wsgi.pyx
>
> A live demo is here: http://www.isotopesoftware.ca/
>
> The problem is in the init_request method.
>
> The current implementation uses threading.local.
>
> I have no idea how to make the WSGI environ object a thread-local in
> case the remote user has been logged in.
>
>
> Any input would be greatly appreciated.
>
> Regards,
>
> Etienne
>
>
> Le 2016-10-10 à 10:30, Etienne Robillard a écrit :
>> Hi,
>>
>> I'm attempting to develop a OAuth 2.0 authentication middleware which
>> sets REMOTE_USER variable into the WSGI environ object, however I'm
>> unable to make this variable unique for the logged user.
>>
>> Is it recommended to use threading.local or gevent to make the WSGI
>> environment persisting on a per-request basis ?
>>
>> What others options can you advise to make private request data not
>> accessible in WSGI ?
>>
>> Thanks in advance,
>>
>> Etienne
>>
>>
>
--------------DFBD501C83F27CDE843840E6
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I think this is not the best mailing list to ask a question like
this. You are probably better served to ask on Stack Overflow or
some other place with more activity.<br>
<br>
For what it's worth, I also think you might misunderstand how WSGI
works. I believe the environment object is supposed to exist in a
request context. I'm assuming you only need one user per request,
so simply filling in the value of REMOTE_USER seems to me like it
should wor<font size="+1">k. However, I haven't looked at your code
or thought long about the problem, it's just an off-handed
observation based on your description below.</font><br>
<div class="moz-signature"><br>
<b>Randy Syring</b><br>
<small>Husband | Father | Redeemed Sinner</small><br>
<br>
<i><small>"For what does it profit a man to gain the whole world<br>
and forfeit his soul?" (Mark 8:36 ESV)</small></i>
<br>
<br>
</div>
<div class="moz-cite-prefix">On 10/11/2016 06:47 PM, Etienne
Robillard wrote:<br>
</div>
<blockquote
cite="mid:c0b081b1-f18f-3ebb-f9f9-e13393c8ec2e-zJpx2rpV7r/[email protected]"
type="cite">Here's the source code:
<a class="moz-txt-link-freetext" href="https://bitbucket.org/tkadm30/django-hotsauce/src/6a862e22e045cb10a84f3b08e4c237ed592ecec7/lib/notmm/controllers/wsgi.pyx">https://bitbucket.org/tkadm30/django-hotsauce/src/6a862e22e045cb10a84f3b08e4c237ed592ecec7/lib/notmm/controllers/wsgi.pyx</a><br>
<br>
A live demo is here: <a class="moz-txt-link-freetext" href="http://www.isotopesoftware.ca/">http://www.isotopesoftware.ca/</a>
<br>
<br>
The problem is in the init_request method.
<br>
<br>
The current implementation uses threading.local.
<br>
<br>
I have no idea how to make the WSGI environ object a thread-local
in case the remote user has been logged in.
<br>
<br>
<br>
Any input would be greatly appreciated.
<br>
<br>
Regards,
<br>
<br>
Etienne
<br>
<br>
<br>
Le 2016-10-10 à 10:30, Etienne Robillard a écrit :
<br>
<blockquote type="cite">Hi,
<br>
<br>
I'm attempting to develop a OAuth 2.0 authentication middleware
which sets REMOTE_USER variable into the WSGI environ object,
however I'm unable to make this variable unique for the logged
user.
<br>
<br>
Is it recommended to use threading.local or gevent to make the
WSGI environment persisting on a per-request basis ?
<br>
<br>
What others options can you advise to make private request data
not accessible in WSGI ?
<br>
<br>
Thanks in advance,
<br>
<br>
Etienne
<br>
<br>
<br>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>
--------------DFBD501C83F27CDE843840E6--
--===============1130978730852735422==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Web-SIG mailing list
[email protected]
Web SIG: http://www.python.org/sigs/web-sig
Unsubscribe: https://mail.python.org/mailman/options/web-sig/gcpw-web-sig%40m.gmane.org
--===============1130978730852735422==--