Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #72924 > unrolled thread

Token-based authentication (was http.server.BaseHTTPRequestHandler basic auth logout? Django authentication system for REST interface?)

Back to article view | Back to comp.lang.python

Contents

  Token-based authentication (was http.server.BaseHTTPRequestHandler basic auth logout? Django authentication system for REST interface?) Demian Brecht <demianbrecht@gmail.com> - 2014-06-07 11:36 -0700

#72924 — Token-based authentication (was http.server.BaseHTTPRequestHandler basic auth logout? Django authentication system for REST interface?)

[Multipart message — attachments visible in raw view] — view raw

On Jun 6, 2014 6:30 PM, "Roy Smith" <roy@panix.com> wrote:
> We would have to keep state on the server side about every extant valid
> token (but then again, we need to do that now, for each session).

If you didn't want to have to manage such state server side, you could opt
to use JWTs (http://datatracker.ietf.org/wg/jose/). A number of auth
providers (including Microsoft and Google) are moving to using these as
well.

Of course, /some/ server side state would have to be managed to deal with
invalidation or any other mutable data that doesn't belong in a token, but
it's generally minimal.

[Shameless plug] I've implemented a subset of the algorithms for both JWE
and JWSs as a part of https://pypi.python.org/pypi/jose.

[toc] | [standalone]

Back to top | Article view | comp.lang.python

csiph-web