tags:

views:

51

answers:

1
Q: 

Access User object when generating a feed in Django

I'm working on a website that keeps track of upcoming homework assignments. I'd like to provide an RSS/Atom Feed that shows their upcoming assignments. However, I have no idea how I'm going to limit the items in the feed to their own, as not many feed readers support cookie-based sessions.

Basically, I need to access the request object inside the feed class and accept HTTP basic/digest auth. Is this even possible?

I'm using Django 1.1, Python 2.5.4, and mod_python 3.3.1

+2  A: 

The approach that's compatible with the widest range of feed readers is to encode the user ID (or user name) in the feed URL. That's "security by obscurity", which is way less than ideal, but for people using, say, Google Reader, it may be the best you can do.

Dave W. Smith  2009-09-30 03:27:36
So you're saying that I should use something like `example.com/feeds/feedname/username/` ? Or do you think I should mangle the username with something such as base64, so it's not quite so obvious?
bluejeansummer  2009-09-30 14:40:22
For each user, you could auto-generate a MD5 hash of their username and a secret salt. So the feed URL would be http://example.com/feeds/feedname/username/hash/ That way, you can look up the feed items by username, and authenticate against the md5 hash. That way no one can guess the URL to see another user's feed.
sixthgear  2009-09-30 19:59:10
I suppose that will work, though it will make for long urls. Thank you!
bluejeansummer  2009-10-01 00:11:20

related questions

How do I write Firefox add-on that automatically enters proxy passwords?
Login Integration in PHP
Strange Rails Authentication Issue
Concurrent logins in a web farm
Is there a browser equivalent to IE's ClearAuthenticationCache?
How can I authenticate using client credentials in WCF just once?
Why can't I connect to my CAS server with Perl's AuthCAS?
Best Solution For Authentication in Ruby on Rails
Authenticate on an ASP.Net Forms Authorization website from a console app
How do I use NTLM authentication with Active Directory
What have you used Windows CardSpace for, if anything
Forms Authentication across Applications
Retreiving the PC Name of a Client? (Windows Auth)
How would you implement FORM based authentication without a backing database?
What's the best way to authenticate over WCF?
Only accepting certain ajax requests from authenticated users
OpenID authentication in Ruby on Rails
OpenID Attribute Exchange - should I use it?
OpenID: which provider should I recommend to my users?
What to use for login ID?
ASP.NET authentication: user name Vs User ID
How do I add SSL to a .net application that uses httplistener - it will *not* be running on IIS
How can I get the authenticated user name under Apache using plain HTTP authentication and PHP?
Checklist for IIS 6/ASP.NET Windows Authentication?
The Definitive Guide To Website Authentication