[geeklog-devel] Webservices API in CVS

[Dirk Haun]

Blaine Lang wrote:


>Although, I think the full power of webservices would be seen if we did 

>implement security and this is how it could be implemented:

>

>You send a "authenticate" verb (...)


Authentication is, of course, handled by the protocol the webservices
uses. So Atompub in this case:


>14.  Securing the Atom Publishing Protocol

>

>   The Atom Publishing Protocol is based on HTTP.  Authentication

>   requirements for HTTP are covered in Section 11 of [RFC2616].

(...)

>   At a minimum, client and server

>   implementations MUST be capable of being configured to use HTTP Basic

>   Authentication [RFC2617] in conjunction with a connection made with

>   TLS 1.0 [RFC2246] or a subsequent standards-track version of TLS


(actually, I think it's currently only doing Basic Authentication,
without TLS - but then again that's about as secure as a direct login)

Once authenticated, it's like the user logged directly into the Geeklog site.

bye, Dirk


-- 
Geeklog Day at FrOSCon: August 25, 2007 - See you there!
http://www.geeklog.net/article.php/geeklog-day-at-froscon