xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2025-01-17 21:23:18 +00:00
Code Issues Projects Releases Wiki Activity

Add '/session/logout' to http api

Browse Source 
Provide a means for an http request to erase
it's own session's validity.  Always return 200
to allow a client to send bogus credentials and
think they got success to forget the auth data in
the browser.
This commit is contained in:
Jarrod Johnson 2016-02-27 11:40:26 -05:00
parent ba6b7cf517
commit f20cdfe49a
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
confluent_server/confluent/httpapi.py
View File

@ -199,12 +199,17 @@ def _authorize_request(env, operation):
if 'confluentsessionid' in cc:
sessionid = cc['confluentsessionid'].value
if sessionid in httpsessions:
if env['PATH_INFO'] == '/session/logout':
del httpsessions[sessionid]
return ('logout',)
httpsessions[sessionid]['expiry'] = time.time() + 90
name = httpsessions[sessionid]['name']
authdata = auth.authorize(
name, element=None,
skipuserobj=httpsessions[sessionid]['skipuserobject'])
if (not authdata) and 'HTTP_AUTHORIZATION' in env:
if env['PATH_INFO'] == '/session/logout':
return ('logout',)
name, passphrase = base64.b64decode(
env['HTTP_AUTHORIZATION'].replace('Basic ', '')).split(':', 1)
authdata = auth.check_user_passphrase(name, passphrase, element=None)
@ -306,6 +311,10 @@ def resourcehandler_backend(env, start_response):
operation = querydict['restexplorerop']
del querydict['restexplorerop']
authorized = _authorize_request(env, operation)
if 'logout' in authorized:
start_response('200 Sucessful logout')
yield('200 - Successful logout')
return
if 'HTTP_SUPPRESSAUTHHEADER' in env:
badauth = [('Content-type', 'text/plain')]
else: