Mailman 3 August 2006 - Twisted-web

Re: [Twisted-web] [Nevow] new chapter about authentication
by glyph＠divmod.com Aug. 4, 2006

Aug. 4, 2006

On Thu, 03 Aug 2006 19:58:58 -0500, "L. Daniel Burr" <ldanielburr(a)mac.com> wrote: >On Thu, 03 Aug 2006 17:54:54 -0500, Valentino Volonghi aka Dialtone ><dialtone(a)divmod.com> wrote: >I think this whole discussion is based on a misunderstanding. I agree. >To me, the bottom line is this: If all you are ever going to do is build >web applications, then you will *never* see any real point in jumping >through all of cred's hoops (portal, avatar, mind, WTF? Guard _should_ support single-sign-on systems like OpenID or Active Directory, to minimize the number of passwords that users have to remember when interacting with Twisted sites. If it did, it would be a lot easier to sell some of the learning required to use it well. But I think that we could do a lot to make the learning seem easier: once over the initial hump, guard is not hard to use and the conceptual design is very simple. >I just want a freaking username/password combo, secured by SSL, like almost >every other web app on Earth!). Until we can address the prevelance of username/password systems, Guard should pretty do what it does and get out of your way. I don't think that it should present any additional difficulty due to the fact that it's trying to do more than usernames and passwords: in fact, guard _ONLY_ supports usernames and passwords right now. I think that interacting with it through a slightly higher-level system like Mantissa is pretty easy, so some focus on a bit of boilerplate to hide some of the more advanced details would be good. Where people tend to get tripped up is the fact that Guard treats resources as objects or capabilities, whereas the typical web mentality is to treat them as files or functions. Despite the fact that it's a very common mentality, it leads to atrocious, insecure code. I think we should be doing everything possible to make the advantages of the guard model clear, and not providing a bug-prone and flaky way to do authentication simply because it seems comfortable and familiar. I strongly believe that the capability-style authentication that guard provides is significantly more secure than the typical crap that ends up in most web applications. This has nothing to do with other protocols, except for the fact that programmers writing code to speak other protocols don't have the baggage of thinking of every chat room as a file on disk, or every email as a stateless, universally accessible object which customizes itself on demand. In a guard-style application, your resources look like this: class NormalResource(...): def __init__(self, userObj): self.userObj = userObj def child_lala(self): return HarmlessResource(self.userObj.harmlessStuff) class AdminResource(NormalResource): def child_rootme(self): return DestroyEverythingResource(self.userObj.stuffAllowedToDestroy) def child_lala(self): return NotQuiteHarmlessResource(self.userObj.harmlessStuff) Whereas what most web developers, only recently dragged in from PHP, _want_ to do is this: ADMIN_USERNAMES = ['bob', 'jim', 'me'] class IDontKnowAnythingAboutEncapsulationResource(...): def child_lala(self): global PAGE_MODE global HARMLESS_STUFF global USERNAME PAGE_MODE = 'harmless' HARMLESS_STUFF = getHarmlessStuff(USERNAME) if USERNAME.lower() in ADMIN_USERNAMES: PAGE_MODE = 'not_quite_harmless' return self def child_rootme(self): global PAGE_MODE global ALLOW_DESTROY PAGE_MODE = 'rootme' global USERNAME if USERNAME.lower() in ADMIN_USERNAMES: ALLOW_DESTROY = getAllowedToDestroyStuff(USERNAME) else: PAGE_MODE = '404' return self Obviously I'm exaggerating somewhat for effect here, but this really is a common style, especially once you realize that the database, the request, the session, and the context are all just different forms of global variables. Due to the resources-are-files mentality, it has become conventional wisdom that passing arguments to the constructors of objects is a hardship, if those objects happen to be resources. This should stop. Just about every other kind of programming seems to be on board with the whole "global variables are bad" thing. Also, did you spot the hidden security bug in the second example? '.lower()' is locale dependent, so the security check in child_rootme may be wrong depending on the locale the server is run in. For example, on a turkish server, 'JİM' would be able to access administrative functions, but 'JIM' would not. Even without weird trivia like that, it's a lot easier to forget an 'if' check for authentication on a sensitive operation than to accidentally implement it in the wrong class, or accidentally implement it twice.

2 1

Nevow application layout
by Manlio Perillo Aug. 4, 2006

Aug. 4, 2006

Hi. Since now I'm going to define the structure of my application I'm try to understand the best layout (for source files). Valentino suggest this: /ProjectName /static /i - images /s - styles /j - javascript /template /doc /database - sql files /bin - various scripts /projectname - python modules /web - for the web stuff /storage - for the data layer /other_eventual_twisted_using_subparts common_python_modules.py But I don't understand why this is better then: - store template dir inside the web dir - the same for static dir - store the database files/dir inside the storage dir Moreover, why use short names for static subdir? Apart this, I like this general structure. I have added a section to the nevow-deployment (not sure this is the right place) in my private branch. Thanks Manlio Perillo

1 0

[Nevow] about new guard in sandbox
by Manlio Perillo Aug. 3, 2006

Aug. 3, 2006

Hi again. I have read the draft implementation of guard in Valentino's sandbox and I like it. However I have some questions: - why the ISessionMenager interface does not include a name attribute (since the default Session class uses the private _name)? - why Session.authenticatedAs has to be a property? - I think that there is no need to store tha password but only the username, so authenticatedAs -> avatarID - what's the use for the guard attribute in Session? - I think that ISessionManager should not have the loggedIn method. - as I can see the code in SessionManager._tick causes the log "Session %r expired" to be issued two times. - what's the use for mind in a web authentication? - why credInterface is a variable? It can be something different from IResource? - Session.sessionLifetime is only used on the server side but never set on the cookie. Only persistent cookies have a not null expiration date. - As I can see in SessionWrappper.locateChild the code request.session = session is executed twice (the first time in getSession. Thanks Manlio Perillo

2 13

FileSaver bug
by Alex Greif Aug. 2, 2006

Aug. 2, 2006

Hi On windows XP (python 2.4.2) the latest svn checkout produces the following bug: FileSaver converts LF to CRLF automatically, even in binary files!! I tried to upload files with the following code: child_uploadfile = static.FileSaver(destination='d:/agreif/tmp', expectedFields=['filename'], maxBytes=10000000, allowedTypes=[http_headers.MimeType('text', 'x-python'), http_headers.MimeType('application','x-zip-compressed')]) here is the hexdump of two samples. You see that in front of every occurrance of "0A" a "0D" is inserted. Sample 1: textfile orig: 68616C6C6F0A uploaded: 68616C6C6F0D0A Sample 2 binary file (zip) orig: 504B03040A00000000001589FF34D13172B90500000005000000100000004E6575205465787464617465692E707968616C6C6F504B010214000A00000000001589FF34D13172B905000000050000001000000000000000010020000000000000004E6575205465787464617465692E7079504B050600000000010001003E000000330000000000 uploaded: 504B03040D0A00000000001589FF34D13172B90500000005000000100000004E6575205465787464617465692E707968616C6C6F504B010214000D0A00000000001589FF34D13172B905000000050000001000000000000000010020000000000000004E6575205465787464617465692E7079504B050600000000010001003E000000330000000000 Alex.

4 6

Cookie support in Twisted Web
by Manlio Perillo Aug. 1, 2006

Aug. 1, 2006

Hi. I don't understand how Cookies are implemented in Twisted Web. The implementation seems to follow the old Netscape spec but it also have the attributes comment (but not commentURL) and max-age. Moreover (and more important): what happens if I both specify expires and max-age? Thanks Manlio Perillo

1 0

How to disable directory listing
by Alex Greif Aug. 1, 2006

Aug. 1, 2006

if the url points to a directory resource, then a list of the folder contents is displayed. How can this behaviour be disabled in web2? Alex.

3 2

Re: [Twisted-web] documentation -- Techno Turkey's fifth adventure
by lloyd＠paisite.com Aug. 1, 2006

Aug. 1, 2006

Hi Folks, Sounds like I kicked off a vital and worthy discussion with my questions/request re: development environment. Very exciting! My instincts tell me that it'w worth letting this discussion run it's course for another couple of days until we arrive at a consensual plan-of-attack. Best I can contribute is a summery of suggestions to date: Development Environment: -- Valentino suggests we take a look at: > An alternative for Nevow is using Combinator (explained in the Divmod > Combinator page): http://divmod.org/trac/wiki/DivmodCombinator > Another alternative for Nevow is using setuptools although I'm unsure how > working itis. Yet another for both is using .pth Twisted Coding Standards -- Valentino also suggests we review: > http://twistedmatrix.com/projects/core/documentation/howto/policy/coding-st… -- glyph suggests: There is actually an under-maintained Axiomatic plugin in Mantissa which helps with this somewhat; it probably doesn't work at the moment, but check out "axiomatic mantissa". It might help with this kind of setup, or at least provide some ideas for tools to expedite the turkey's adventures. Directory Structure -- Daniel says: > While you are correct that no specific directory layout conventions have > been blessed by the core development team, I think that there is a lot of > value in providing one, if only to give really new users some kind of > structural anchor point from which to begin learning web-app development > with twisted. (Speaking for the turkey contingent, I heartily agree.) -- Daniel suggests: /ProjectName /packagename /static /css /js /images module1.py module2.py ... -- Valentino counters: /ProjectName /static /i - images /s - styles /j - javascript /template /doc /database - sql files /bin - various scripts /projectname - python modules /web - for the web stuff /storage - for the data layer /other_eventual_twisted_using_subparts common_python_modules.py -- Manlio asks: > An interesting question is: when one should consider the option of serving > static content with a server like lighttpd, and forward with mod_proxy > requests for dynamic content to twisted web? > static.File is a no match versus lighttpd, but there is the overhead of > mod_proxy and one should also consider how to design the site layout at > the best. .pth vs. PATH -- Daniel says: > I suggest using .pth files rather than path variables. Using .pth files > should "just work" regardless of your OS, and not require any fiddling > around with the environment by hand. > So, basically, for a new web project, you'd create your project dirs, and > then stick a "myproject.pth" file in the site-packages directory, > containing "/path/to/my/project/topmost/folder" Testing development environment > To test that the dev environment is set up correctly, I'd just start up a > python interpreter prompt and import twisted, then import nevow, and > lastly, import myprojectpackage. Running Twisted code -- Daniel suggests: > I probably sound like a broken record, but I'd suggest offering one, and > only one, way to run the code, so that users aren't fiddling with things > that are not central to grasping the concepts being presented. > Me, I use .tac files for everything these days, so that's what I would > recommend for use within the tutorials. Seems to me that these are all open questions worth consideration and further discussion and clarification. As soon as we have some degree of mutual understanding and concensus, we can discuss how to implement the Turkey's Guide for Diving into Twisted or whatever we decide to call it, as well as where to put it. Meanwhile... I'll post the next draft of Dialtone's Resource Magic on http://twisted.paisite.com, incorporating suggested changes. Many many thanks to all. Best wishes, Lloyd

4 12