[web2py] Re: Force authentication to whole app

2015-02-13 Thread JorgeH
This should really go in documentation ;) On Friday, February 13, 2015 at 5:19:33 AM UTC-5, mcamel wrote: > > Cool!. > > It works perfectlly on controllers files, but causes infinite recursion in > auth model file. > > So if you want to apply it to your whole app, writing it once and in one > pl

[web2py] Re: Force authentication to whole app

2015-02-13 Thread mcamel
Cool!. It works perfectlly on controllers files, but causes infinite recursion in auth model file. So if you want to apply it to your whole app, writing it once and in one place, this can be used in auth model, after defining auth: if request.url != auth.settings.login_url: auth.requires_l

[web2py] Re: Force authentication to whole app

2015-02-12 Thread Anthony
A decorator is just a special type of function that takes a callable and returns another callable. You typically use it via the "@" syntax, but you don't have to use it that way. @auth.requires_login() def myfunc(): return dict() is equivalent to: def myfunc(): return dict() myfunc = a

[web2py] Re: Force authentication to whole app

2015-02-12 Thread Tom Campbell
> > To take advantage of the decorators at a file level, you can also do this > at the top level of a file: > > auth.requires_login()(lambda: None)() > > The decorators ultimately call auth.requires, which itself returns a > decorator. The above passes a dummy function to that decorator and then

[web2py] Re: Force authentication to whole app

2015-02-12 Thread Anthony
To take advantage of the decorators at a file level, you can also do this at the top level of a file: auth.requires_login()(lambda: None)() The decorators ultimately call auth.requires, which itself returns a decorator. The above passes a dummy function to that decorator and then simply calls

[web2py] Re: Force authentication to whole app

2015-02-12 Thread mcamel
I basically agree you. I use auth decorators with my functions. This is just an extra security mechanism, set once in one single place. Then you forget about it. It only has sense in some kind of applications. It could be used instead of auth decorators only in extremelly simple apps where you

[web2py] Re: Force authentication to whole app

2015-02-12 Thread Leonel Câmara
I think the first one (with more exceptions for register, lost password, etc) is an acceptable solution. However, when you start making more exceptions then it just starts being messy, unreadable, and I would just start decorating my controller functions (all of them if necessary). That's why i