Re: auth cache

On Mon, Feb 24, 2003 at 08:58:47AM -0700, David Waite wrote:
> Ben Collins-Sussman wrote:
> >Garrett Rooney <rooneg@electricjellyfish.net> writes:
> >>huh? we've still go the auth baton, assuming that they used the same
> >>client context, so why can't we cache the authentication stuff there,
> >>keyed off of repos uuid (once we have those working anyway).
> >
> >Ah! Now *there's* a caching solution that might work. gstein, this
> >fixes the security problem, doesn't it? Is keying off the repos uuid
> >enough, or are there other runtime params we need to worry about?
>
> I think you need to key off of both the uuid and the server address;
> otherwise I can 'trick' your client to providing me your auth
> credentials for a specific server by manually setting the uuid to match ;-)

Right.

The appropriate set of things to feeding into any cache key is pretty
dependent upon the set of providers that you're using and what *their*
inputs are. That's why I don't think a general cache is going to work, but
one tuned to the particular environment.

Cheers,
-g

-- 
Greg Stein, http://www.lyra.org/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org