Esempio n. 1
0
	def GetUserID( cls, request ):
		"""Gets the user ID associated to this request, if any."""
		connection_cookie = request.cookie(cls.COOKIE_CONNECTION)
		if connection_cookie > 64:
			crypted = base64.decodestring(connection_cookie[64:])
			user_id = crypt_decrypt(crypted, cls.CRYPT_KEY)
			if user_id != "anonymous":
				return user_id
		return None
Esempio n. 2
0
	def CreateSessionCookie( cls, request, userid="anonymous" ):
		"""The session cookie is made of two part, separated by a `:`. The
		first part is a salted hash of the client's IP and user agent,
		the second one is an encrypted user id.

		This mechanism is definitely not very secure against cookie stealing,
		as if the attacker has the same IP and uses the same user agent
		he will be able to access this.
		"""
		# FIXME: Add userAgent as well is the first part
		address = str(request.clientIP()) + cls.COOKIE_CONNECTION_SALT
		# FIXME: UserId should be encrypted with some part of the request as well
		user_id = base64.encodestring(crypt_decrypt(str(userid), cls.CRYPT_KEY))[:-1]
		return hashlib.sha256(address).hexdigest() + str(user_id)