Closed (fixed)
Project:
Services
Version:
6.x-3.x-dev
Component:
Code
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
1 Jan 2011 at 17:50 UTC
Updated:
27 Jan 2011 at 01:09 UTC
Jump to comment: Most recent file
The only reason the session auth module ever existed was to manage clients that could not pass cookies (mainly Drupal's internal XMLRPC client.) This has however been fixed in D7 since you can pass headers through to xmlrpc(), so I propose that we just remove the module. Without the module, Services just uses the cookies and login sessions anyways. I think there is some code hanging around I put in to support this we could remove as well, centered around these commits.
https://github.com/heyrocker/services/commit/241622fce8e3244c6fee9d91b99...
https://github.com/heyrocker/services/commit/175a358d35aef35bdab949141c8...
Thoughts? It just seems like it is going to confuse people.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | 1012132.patch | 6.62 KB | gdd |
Comments
Comment #1
kylebrowning commentedComment #2
voxpelli commentedGetting rid of this hack can only be good. I'm +1 on this.
Comment #3
voxpelli commentedThis could be related to #1015994: Securing a SOAP service - we know that Drupal support using cookies for sessions with XML-RPC - but what about SOAP? Would it fit in a regular SOAP-workflow? If not - should we care or could a third party module care instead?
Comment #4
gddThat SOAP issue got closed so I'm not going to worry about it. If anyone wants to implement this for non-cookie-clients there is nothing stopping them from doing it in contrib (I think)
Comment #5
gddSo I am foggy exactly what I was after when I wrote this, but I had added an extra parameter to get passed through the chain that contained auth parameters. Tis provided a method for non-cookies to get passed through to the REST server. I would have to go back and reacquaint myself with all this to determine if removing that param would hobble any attempts to implement this in contrib. Regardless this patch reverts REST server and Services back to where they were before I added in Session Auth.
Comment #6
andyjh122 commentedI'm using it to maintain user logged in state for xmlrpc calls and grab files based on user roles and permissions.
Will I be able to do this without session auth? Or is the logged-in cookie value separate than the session auth logic in services?
Comment #7
marcingy commentedYes you just need to make sure you pass the cookie in on the header - session auth was created to work round a limitation of drupal's xmlrpc client that didn't allow for cookie to be passed via as header (or indeed any other value). You will need to amend your code to send cookies as a header and once that is done your application should continue to operate as it does now.
If it doesn't let us know as that will allow us to fix the issues that you are experiencing, as this module should no longer be required.
Comment #8
gddIn Drupal 7 this can be done out of the box because xmlrpc() allows you to pass headers. In Drupal 6 this will still be an issue. There is a patch to core to change this in Drupal 6, sadly it was rejected by Gabor. That issue will have to be discussed.
Comment #9
gddThis has been committed to 7. It just occurred to me we might also want an update function for anyone using this?
I'm tempted to remove from 6 even though the patch to fix this didn't get committed. We can just indicate it requires the patch? it sucks but this is such a hack.
Comment #10
andyjh122 commentedCan we just keep the session auth module as an optional patch?
Comment #11
andyjh122 commentedCan close, I've modified my app to not use session auth.
Thanks!
Andrew
Comment #12
kylebrowning commentedWe will keep sessauth in 6.x but it is removed in 7.x If there is ever a time we need to modify this, we can just move it out of core and into contrib.