Services and Authentication

In the previous chapter we have discussed the use of the following decorators:

@auth.requires_login()
@auth.requires_membership(...)
@auth.requires_permission(...)

For normal actions (not decorated as services), these decorators can be used even if the output is rendered in a format other than HTML.

For functions defined as services and decorated using the @service... decorators, the @auth... decorators should not be used. The two types of decorators cannot be mixed. If authentication is to be performed, it is the call actions that needs to be decorated:

@auth.requires_login()
def call(): return service()

Notice that it also possible to instantiate multiple service objects, register the same different functions with them, and expose some of them with authentication and some not:

public_service=Service()
private_service=Service()
@public_service.jsonrpc
@private_service.jsonrpc
def f():
    return 'public'
@private_service.jsonrpc
def g():
    return 'private'
def public_call():
    return public_service()
@auth.requires_login()
def private_call():
    return private_service()

This assumes that the caller is passing credentials in the HTTP header (a valid session cookie or using basic authentication, as discussed in the previous chapter). The client must support it; not all clients do.

If using ServerProxy() described above, you can pass basic authentication credentials in the URL, like so:

URL='http://user:password@127.0.0.1:8000/app/default/private_call/jsonrpc2'
service = ServerProxy(URL, version='2.0')

where the function private_call in the controller is decorated for user authentication