aiohttp-security/docs/usage.rst

43 lines
1.1 KiB
ReStructuredText
Raw Normal View History

2015-11-08 02:47:19 +00:00
.. _aiohttp-security-usage:
=======
Usage
=======
.. currentmodule:: aiohttp_security
.. highlight:: python
The library is build on top of two policies: :term:`authentication`
2015-11-18 10:07:42 +00:00
and :term:`authorization` and public API.
API is policy agnostic, all client code should not call policy code
directly but use API only.
Via API application can remember/forget user in local session
(:func:`remember`/:func:`forget`), retrieve :term:`userid`
(:func:`authorized_userid`) and check :term:`permission` for
remembered user (:func:`permits`).
2015-11-08 02:47:19 +00:00
Authentication
==============
Actions related to retrieving, storing and removing user's
:term:`identity`.
Authenticated user has no access rights, the system even has no
knowledge is there the user still registered in DB.
2015-11-18 10:07:42 +00:00
If :class:`aiohttp.web.Request` has an :term:`identity` it means the user has
2015-11-08 02:47:19 +00:00
some ID that should be checked by :term:`authorization` policy.
2015-10-29 08:31:24 +00:00
identity is a string shared between browser and server.
2015-11-08 02:47:19 +00:00
Thus it's not supposed to be database primary key, user login/email etc.
2015-10-29 08:31:24 +00:00
Random string like uuid or hash is better choice.