Twisted Web in 60 seconds: HTTP authentication

[jcalderone]

Welcome to the 14th installment of "Twisted Web in 60 seconds". In many of the previous installments, I've demonstrated how to serve content by using existing resource classes or implementing new ones. In this installment, I'll demonstrate how you can use Twisted Web's basic or digest HTTP authentication to control access to these resources.

Comments

Http-authentication & "tac"-style

[anonymous]

I don't seem to be able to figure out how to use HTTPAuthSessionWrapper in a tac-file, i.e. when the service is defined in this fashion
root = Resource()
application = service.Application('auth-demo')
demo_server = strports.service('tcp:8088', server.Site(root))
demo_server.setServiceParent(application)

and I'd need to add the HTTPAuthSessionWrapper resource as a child to the root?

Trying to use HPPTAuthSesseionWrapper instance as the root resource in server.Site didn't seem to get me anywhere either.

Re: Http-authentication & "tac"-style

[jcalderone]

Adding the HTTPAuthSessionWrapper as a child to the root is definitely an option. That works just like you'd expect:

root = Resource()
wrapper = HTTPAuthSessionWrapper(...)
root.putChild("foo", wrapper)
demo_server = strports.service('tcp:8088', server.Site(root))
...

As of Twisted 9.0, you can also use the HTTPAuthSessionWrapper as the root resource itself (there are problems with this in 8.2, though):

root = HTTPAuthSessionWrapper(...)
demo_server = strports.service('tcp:8088', server.Site(root))

BasicCredentialFactory available from which version?

[anonymous]

Since when has twisted.web.guard.BasicCredentialFactory been around?
'Since' dates on the twisted api docs would be a great thing

http://twistedmatrix.com/documents/8.2.0/api/twisted.web.guard.html

Thanks
Brad

Re: BasicCredentialFactory available from which version?

[jcalderone]

It's been around since at least 8.2. The link you gave gives an empty page because of a bug in the API generation tool. :/

We have recently started marking up new APIs with "since" information, too.