Re: Login-based session

Tim Golden wrote:
> >> On 5/2/07, Tim Golden <tjgoldengmail.com> wrote:
> >>> So as not to reinvent the wheel, I'd like
to be able to key 
> >>> a cherrypy session against the logged-in
user (which, since
> >>> I'm using mod_auth_sspi under Windows I'm
going to assume
> >>> will always be present). This means,
AFAICT, *not* using a
> >>> cookie-based Session object, but rather
one which picks up
> >>> its id from the cherrypy.request.login.
I've looked through
> >>> the wiki/groups but I can't see a simple
recipe which seems
> >>> to match my needs.
> 
> [Robert Brewer]
> > Yeah, but if you're doing strong auth do you
really need sessions?
> 
> Not sure I follow that. I want, in essence, to track a
user's
> preferences no matter which machine they're logged on
to (and
> hence independently of cookies). I assume that sessions
are the
> way to do that - where session means "take some id
and give me
> some info relating to it" - and user's
passed-through username
> seems a sensible id. Maybe we're just using
"session" in
> different senses?

Yes, we are. 
"Session" in my vocabulary means data that
persists from
user login to (possibly ephemeral) logout only, and most web
frameworks'
session tools are designed to strongly support this
expiration model
(and most are pretty bad at every other aspect of data
management). If
you only have data that is per-user (not
per-browser-session), you're
better off using a more robust database solution instead of
session
tools (which tend to be more fragile and inflexible).

I recommend you skip any CP session tool and just make your
own
UserPrefs table in your DB, and key it and index it by user
ID. If your
user list is small, cache it in RAM.


Robert Brewer
System Architect
Amor Ministries
fumanchuamor.org

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "cherrypy-users" group.
To post to this group, send email to cherrypy-usersgooglegroups.com
To unsubscribe from this group, send email to
cherrypy-users-unsubscribegooglegroups.com
For more options, visit this group at h
ttp://groups.google.com/group/cherrypy-users?hl=en
-~----------~----~----~----~------~----~------~--~---

Robert Brewer wrote:
> "Session" in my vocabulary means data that
persists from
> user login to (possibly ephemeral) logout only, and
most web frameworks'
> session tools are designed to strongly support this
expiration model
> (and most are pretty bad at every other aspect of data
management). If
> you only have data that is per-user (not
per-browser-session), you're
> better off using a more robust database solution
instead of session
> tools (which tend to be more fragile and inflexible).

On reflection I had realised that this was probably
what you'd meant. I'd started rolling-my-own prefs
database before thinking "Isn't that what sessions
are? I'm sure there's something there already." But
I do understand the distinction you're drawing.

> I recommend you skip any CP session tool and just make
your own
> UserPrefs table in your DB, and key it and index it by
user ID. If your
> user list is small, cache it in RAM.

That's fine; it's what I'd thought of doing anyway.

Thanks for the input.

TJG

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "cherrypy-users" group.
To post to this group, send email to cherrypy-usersgooglegroups.com
To unsubscribe from this group, send email to
cherrypy-users-unsubscribegooglegroups.com
For more options, visit this group at h
ttp://groups.google.com/group/cherrypy-users?hl=en
-~----------~----~----~----~------~----~------~--~---