Subject: Re: [weirds] JSON generation python lib

From: Gavin Brown <[email-masked]>
Date: Thu, 20 Dec 2012 10:16:09 +0000

> I did not look hard enough to make rdapper understand authentication
> (obvious --username and --password did not help). Really want to get
> to our public-facing weirds first.

Authentication was added on tuesday - it should work with any server
supporting basic authentication (it certainly works with ours). SSL
client cert support was also added at the same time.

One gotcha is that rdapper constructs its own "Authorization" header
rather than using LWP::UserAgent's credentials() method, for the reason
that I imagine that if there was a  server, supporting both anonymous
and authenticated clients, the server would not send a 401 response,
which would cause LWP::UserAgent to resubmit with the provided credentials.

If you had a server that used digest authentication, then you'd have to
have a separate endpoint for authenticated access, in order to send the
nonce to the client.

G.

-- 
Gavin Brown
Chief Technology Officer
CentralNic Ltd
Innovative, Reliable and Flexible Registry Services
for ccTLD, gTLD and private domain name registries
https://www.centralnic.com/

CentralNic Ltd is a company registered in England and Wales with company
number 4985780. Registered Offices: 35-39 Moorgate, London, EC2R 6AR.

---

From: Alex Sergeyev <[email-masked]>
Date: Thu, 20 Dec 2012 06:53:08 -0500

> which would cause LWP::UserAgent to resubmit with the provided credentials.

Server supporting both authenticated and public access to data is my case.
(I think if auth supplied it should be sent to the server by your app)

BTW, I offered it before because it's just how some clients work,
it would be good to have optional way to specify smth like this in the request:

/domain/example.net?drop_privileges (server ignores auth even if my
HTTP client sends it)
/domain/example.net?require_auth    (server would fail with 401 if no
auth is supplied)

There is many libs around that would do things in irritating manner
with HTTP Auth. All browsers,
will not drop authentication (not sure if you can force it by
Javascript), therefore plugins or
dynamic scripts would not be able to request "regular" version of
documents once permissions
with username/password are elevated.

BTW
It's relatively trivial to add digest auth to  my example app. If you
do it faster than I'll get to it, feel free to send pull request.

Alex.