[Twisted-web] [Twisted-Python] Is it necessary to utilize twisted.cred in twisted web?
phil at bubblehouse.org
Tue Oct 6 01:31:50 EDT 2009
crossposted to twisted-web at twistedmatrix.com, which is probably a
On Oct 6, 2009, at 12:08 AM, biziap biziap wrote:
> I have googled this topic and found and example in
> (A) http://firstname.lastname@example.org/msg01796.html
> well, another simpler example is
> (B) http://email@example.com/msg01788.html
> My questions are:
> 1. Does the approach in (A) be recommended? To generate resource
> dynamically seems not efficient and not necessary for simple scenario.
> Is there other way to bind twisted.cred and twisted.web together?
> (except the deprecated twisted.web.guard)
There's a few problems with this approach. The biggest is that it
requires username/password data to be sent on every authenticated
Another one is more of a design principle; that you shouldn't have
account/permissions code inside resource display code. I violate this
principle all the time ;-)
The use of dynamic resource instantiation is a common idiom in
twisted.web coding, though. it isn't inherently inefficient, as long
as your resource objects are fairly sane.
> 2. The approach in (B) which suggests that request.getSession() along
> is quite enough to implement an simple authentication feature. Here
> the "simple scenario" means to guard some resource with username and
> To do it: In a protected resource, just to check for a flag in the
> session, if failure, then redirect to login page. If succeeded, render
> the resource. Why shall we bother the portal, credentials,
> checker,.... ?
true, depending on your needs, this may be all that you need. from
your description, though, it sounds like you'd be doing this
authentication step in every resource you want to protect, which could
become tedious (aka error-prone) in a big project.
twisted.cred can seem daunting when you're just trying to protect a
trivial web resource or two, but for more advanced uses like more
complicated authentication levels, it's worth the time to learn. also,
a big part of its real value comes when you need to support a variety
of protocols and/or authentication types.
More information about the Twisted-web