Re: CSRF protection and session factories

2011-03-10 Thread Wichert Akkerman
On 3/9/11 21:06 , Ben Bangert wrote: So I guess I would consider a CSRF token to be usable and valid from the users login, to the users logout on your website. If there was a way to steal cookies from your users, the CSRF token wouldn't matter since the attacker could use the stolen cookie to

Re: pyramid start example (4.1) does not run on my machine

2011-03-10 Thread armen
hi everybody, This is what I did. 1)I installed a virtualenv catalogue named env 2)I activated the virtualenv, a prefix (env) appeared in my prompt 3)finally I typed easy_install pyramid Unfortunately the above error appears, local python shell has pyramid installed. What drives me crazy is that

Re: pyramid start example (4.1) does not run on my machine

2011-03-10 Thread Chris McDonough
My only guess is that you're not using the virtualenv paster or python when you're trying to start the application. On Wed, 2011-03-09 at 00:16 -0800, armen wrote: Dear community, I am new to pyramid, I followed the installation steps as described in pyramid 1.0 documentation, but when I

Re: Questions for Pyramid talk at PyCon

2011-03-10 Thread Chris McDonough
Might be nice to talk about Akhet (nee pylons_sqla) for ex-Pylons folks. It's not released but hopefully shortly. On Wed, 2011-03-09 at 11:03 -0600, Carlos de la Guardia wrote: Hi, I'll be doing a talk about frequently asked questions about Pyramid. I'd like to cover technical questions,

Proper HEAD requests?

2011-03-10 Thread Stephen Lacy
What's the recommended way to get proper HEAD request support using pyramid + mod_wsgi? Right now, with my vanilla mod_wsgi configs, and request_method='GET' on my view_config decorators, my HEAD requests are 404'ing. I tried setting request_method=['GET', 'HEAD'] but it seems as this syntax

Re: Proper HEAD requests?

2011-03-10 Thread Reed L O'Brien
On Mar 10, 2011, at 1:44 PM, Stephen Lacy wrote: What's the recommended way to get proper HEAD request support using pyramid + mod_wsgi? Right now, with my vanilla mod_wsgi configs, and request_method='GET' on my view_config decorators, my HEAD requests are 404'ing. I tried setting

Re: Proper HEAD requests?

2011-03-10 Thread Reed L O'Brien
On Mar 10, 2011, at 1:44 PM, Stephen Lacy wrote: What's the recommended way to get proper HEAD request support using pyramid + mod_wsgi? Right now, with my vanilla mod_wsgi configs, and request_method='GET' on my view_config decorators, my HEAD requests are 404'ing. I tried setting

Re: Proper HEAD requests?

2011-03-10 Thread Reed L O'Brien
On Mar 10, 2011, at 2:17 PM, Stephen Lacy wrote: Ah, the custom predicates makes sense, but the syntax is really obtuse. I'll look (briefly) at coding up request_method=('GET', 'HEAD') and submit a pull request if there's no objection here. I suspect it's as simple as replacing == with

Re: pyramid start example (4.1) does not run on my machine

2011-03-10 Thread Simon King
Do you perhaps have another python package called 'pyramid' somewhere on your path (such as a test app)? Try putting the following before the line that is generating the error: import pyramid print pyramid.__path__ Simon On 10 Mar 2011, at 12:46, Sebastian Zwack

Setting cookies in Pyramid for @action()s or HTTPFound redirects?

2011-03-10 Thread Seth
I'm having the hardest time figuring out the best way to set cookies for my methods that don't return a true Response object (and therefore, don't have a set_cookie() method). Is there no such helper in the Pyramid stack? The closest thing I've found so far is the Varying Attributes of Rendered

Re: Setting cookies in Pyramid for @action()s or HTTPFound redirects?

2011-03-10 Thread Stephen Lacy
To me, the answer to this question really lies in what session implementation are you using? For me, I've opted to use a session in a database on the server, which allows me to set arbitrarily large items into the session without any real penalty. Then, for whatever you'd set a custom cookie

Re: Setting cookies in Pyramid for @action()s or HTTPFound redirects?

2011-03-10 Thread Seth
Currently I'm using the default cookie/session factories, but I'm looking to actually set cookies that last longer than the session so the request.session solution doesn't apply (unless I'm missing something there--I don't think it can be given a max_age). The callback method you suggested