16. Authentication
Karrigell supports basic HTTP authentication, a way to protect access to some files by requesting
a user identifier and a password. The server receives user input and stores it in the global
variables AUTH_USER and AUTH_PASSWORD . If the user enters a couple which
is allowed by the server then the page is sent back ; if the couple is not allowed then the user is
requested a new couple ; if the user cancels his request an error message is sent to him
In Karrigell, authentication is handled through the Authentication function ; call
Authentication(testFunction[,realm,
errorMessage]) where testFunction is a user-defined function
taking no argument, which returns true if the authentication test succeeds (depending on the values
of AUTH_USER and AUTH_PASSWORD ) and false otherwise, realm is a
string with the name of the authentication domain (the one that will appear on the popup window) and
errorMessage is a string displayed on the browser if the user cancels his authentication
request. Both realm and errorMessage have default values
Here is an example with a very simple test function :
<%
def authTest():
return (AUTH_USER=="proust" and AUTH_PASSWORD=="marcel")
Authentication(authTest,"Authentication test",\
"Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !
With this test function, if a visitor finds a way to read the source code, he will easily
discover a valid login/password couple. A better solution is to use md5 : it is a function which
takes a string as argument, and returns a 16-bytes "digest". The digest is guaranteed to be
different for two different strings, and it is impossible to find the string if you only know the
digest
A good method is to compute the md5 digests of user and password and store them in a file. The
authentication test will read this file, compute the digests of AUTH_USER and AUTH_PASSWORD, and
return true if the digests match
<%
import md5
digests=open("digest.ini","rb").read()
userDigest=digests[:16]
passwordDigest=digests[16:]
def authTest():
return (md5.new(AUTH_USER).digest()==userDigest and \
md5.new(AUTH_PASSWORD).digest()==passwordDigest)
Authentication(authTest,"Authentication test",\
"Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !
See the k_password.py script, in the admin directory, which generates a file with the md5 digests of
administrator's login and password
|