Improve login security - Githubissues

jholtom / webvirt

WebVirt - LibVirt web managment.

Other

5 stars 1 forks source link

Closed csssuf closed 11 years ago

csssuf commented 11 years ago

pefoley2 commented 11 years ago

Hell yeah. I don't want Robert messing with my VMs.

pefoley2 commented 11 years ago

michaelsmithxyz commented 11 years ago

Reassigned to myself. I have the most experience in this area. I should be able to take care of this tonight.

pefoley2 commented 11 years ago

Done and pushed to master.

michaelsmithxyz commented 11 years ago

In closing, I'll just note a few things for the layprogrammer who might not want to bother with reading my code:

SIDs are SHA256 hashes generated with the current time, shuffled with a random 512 bit value
The Authenticator instance for the current request is stored at web.ctx.authenticator
web.ctx.auth is a boolean to check whether or not the user is logged in
web.ctx.username holds either the current user's username or None if they aren't logged in