SECURITY Flaws in this design for User authentication.

Question

SECURITY Flaws in this design for User authentication.

From: http://wiki.pylonshq.com/display/pylonscookbook/Simple+Homegrown+Authentication

Note: a. Project follows the MVC pattern. b. Only a user with a valid username and password is allowed submit something.

Design: a. Have a base controller from which all controllers are derived from. b. Before any of the actions in the derived controllers are called the system calls a before action in the base controller. c. In each controller user hardcodes the actions that need to be verified in an array. d. The before action first looks in the array that has the actions that are protected and sees if a user is logged in or not by peaking into the session. If a user is present then user is allowed to submit otherwise user is redirected to login page.

What do you think?

Answer 1

I prefer approach with decorating functions that require authentication because it does not require typing action name 2 times - in the function definition and in requires_auth list. In that case you can mistype action name and it would not be noticed by interpreter. Decorating actions does not have this problem:

@authorize(ValidAuthKitUser())
def list(self):
    pass

You also can decorate __before__ function and it will have effect on all controller actions:

@authorize(ValidAuthKitUser())
def __before__(self):
    pass
def list(self): # automatically checks if the user is authenticated
    pass