On Wednesday 27 February 2002 14:07, Magnus Lie Hetland wrote: > This looks great -- but perhaps a bit ambitious? I'm not saying the > project should be scaled down, but that perhaps a more modest > mechanism could be added as an initial step? (It might have a > better chance of actually being implemented... :)
Oh, it was very ambitious - partially because some of the issues can be rather complex when you start talking about integrated authentication with stuff happening outside of Webware like Aaron did today. And how about providing authenticated access to static files that WebKit is serving up? You can't easily use inheritance to do that, unless you start modifying the servlet factories. Coding up a custom solution isn't that hard, but things get much more complicated when we talk about something that is worthy of inclusion in the standard distribution. The last thing we want to do is encourage people to blindly trust a built-in authentication mechanism that may or may not be secure. Anyway, I agree that the best way to get this thing rolling is to do what you and Geoff are suggesting and work up from SecurePage and LoginPage. However, I'd suggested putting them in a separate 'kit', rather than directly in WebKit. 'AuthKit' or even as part of 'UserKit'? Or how about some simple modules attached to the Wiki pages at this stage? > Perhaps simply wrapping up the code from the example in the > distribution in such a way that one could use/inherit it without > knowing how it works? (To make this simple enough, one would > perhaps have to drop the ID field stuff...) See my comment above. Blind faith is dangerous. > My hope was that HTTP auth could give me a ready-made, simple > solution, when Webware didn't have one built-in... Even though I > have one solution implemented, I generally like better to rely on > standard solutions (maintained as part of the distribution) than to > implement my own, when there is no obvious reason for me to do so. Ditto. > > Ng's authcookie extension to m2crypto sounds perfect for this > > sort of stuff, but I have tested it yet. > > Sounds nice... (I guess this would require a separate installation > of m2crypto...?) Yep. Cheers Tavis _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
