From 87d24dd7b19ab710741879408658f7c56e140872 Mon Sep 17 00:00:00 2001 From: Ferry Boender Date: Sat, 4 Jul 2015 16:47:08 +0200 Subject: [PATCH] Rewrote authentication method to be simpler. --- src/webapp.py | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/webapp.py b/src/webapp.py index 681a83e..7f30ffd 100644 --- a/src/webapp.py +++ b/src/webapp.py @@ -294,27 +294,29 @@ class ScriptFormWebApp(WebAppHandler): 401 HTTP back to the client. """ form_config = self.scriptform.get_form_config() - self.username = None + username = None # If a 'users' element was present in the form configuration file, the # user must be authenticated. if form_config.users: - authorized = False auth_header = self.headers.getheader("Authorization") if auth_header is not None: + # Validate the username and password auth_unpw = auth_header.split(' ', 1)[1] username, password = base64.decodestring(auth_unpw).split(":") pw_hash = hashlib.sha256(password).hexdigest() - # Validate the username and password + if username in form_config.users and \ pw_hash == form_config.users[username]: - self.username = username - authorized = True + # Valid username and password. Return the username. + return username + + # Authentication needed, but not provided or wrong username/pw. + headers = {"WWW-Authenticate": 'Basic realm="Private Area"'} + raise HTTPError(401, 'Authenticate', headers) - if not authorized: - headers = {"WWW-Authenticate": 'Basic realm="Private Area"'} - raise HTTPError(401, 'Authenticate', headers) - return self.username + # No authentication required. Return None as the username. + return None def h_list(self): """