summaryrefslogtreecommitdiff
path: root/docs/narr/security.rst
AgeCommit message (Collapse)Author
2019-10-17support Origin: null in csrf_trusted_origins and check_origin=FalseMichael Merickel
2019-10-17Merge pull request #3521 from mmerickel/remove-check-csrf-predicateMichael Merickel
remove check_csrf view predicate
2019-10-17move the interface docs to api/interfacesMichael Merickel
2019-10-17remove check_csrf view predicateMichael Merickel
2019-09-30Merge pull request #3465 from luhn/security-policyMichael Merickel
Security policy implementation
2019-09-23Doc fixes from @DeimosTheron Luhn
2019-09-19Document CSRF allow_no_origin option.Theron Luhn
2019-08-26Doc fix via @mmerickelTheron Luhn
Co-Authored-By: Michael Merickel <github@m.merickel.org>
2019-07-27Fix typosMin ho Kim
2019-07-13Improve security docs.Theron Luhn
2019-06-08First draft of upgrade docs.Theron Luhn
2019-05-26First draft of narrative docs.Theron Luhn
2019-05-12Narrative docs WIPTheron Luhn
2018-10-14Update documentation for implementing custom authz policyBert JW Regeer
2018-08-18Clean up code-blocks in securitySteve Piercy
2017-10-18csrf documentation changeBen Fagin
2017-04-30standardize "non-standard"Steve Piercy
2017-04-29final cleanup of csrf decoupling in #2854Michael Merickel
- Renamed `SessionCSRFStoragePolicy` to `LegacySessionCSRFStoragePolicy` for the version that uses the legacy `ISession.get_csrf_token` and `ISession.new_csrf_token` apis and set that as the default. - Added new `SessionCSRFStoragePolicy` that stores data in the session similar to how the `SessionAuthenticationPolicy` works. - `CookieCSRFStoragePolicy` did not properly return the newly generated token from `get_csrf_token` after calling `new_csrf_token`. It needed to cache the new value since the response callback does not affect the current request. - `CookieCSRFStoragePolicy` was not forwarding the `domain` value to the `CookieProfile` causing that setting to be ignored. - Removed `check_csrf_token` from the `ICSRFStoragePolicy` interface to simplify implementations of storage policies. - Added an introspectable item for the configured storage policy so that it appears on the debugtoolbar. - Added a change note on `ISession` that it no longer required the csrf methods. - Leave deprecated shims in ``pyramid.session`` for ``check_csrf_origin`` and ``check_csrf_token``.
2017-04-26Apply drafting changes to documentation.Matthew Wilkes
2017-04-12Use the webob CookieProfile in the Cookie implementation, rename some ↵Matthew Wilkes
implemenations based on feedback, split CSRF implementation and option configuration and make the csrf token function exposed as a system default rather than a renderer event.
2017-04-12Rename implementation to ICSRFStoragePolicyMatthew Wilkes
2017-04-12Fix tests and documentation in various places, and feedback following reviewJure Cerjak
regarding naming of variables and code cleanup.
2017-04-12Create a new ICSRF implementation for getting CSRF tokens, split out from ↵Matthew Wilkes
the session machinery. Adds configuration of this to the csrf_options configurator commands. Make the default implementation a fallback to the old one. Documentation patches for new best practices given updates CSRF implementation.
2016-06-09grammar, spelling, wrapping fixSteve Piercy
2016-06-08Adding a warning discouraging use of __acl__ properties attributesJulien MIOTTE
2015-10-31minor grammar, rewrap to 79 columnsSteve Piercy
2015-02-17enhance security docs with an example of subclassing a builtin policyMichael Merickel
2015-02-17grammarMichael Merickel
2014-08-13some tweaks to the usage of userid in the docsMichael Merickel
2014-08-12Docs: Switched first 2 paragraphs of security overview.Karl O. Pinc
2014-08-12Docs: Add resource tree into security overview.Karl O. Pinc
2014-08-12Docs: Include the concept of credentials in the high level security overview.Karl O. Pinc
2014-08-12Docs: Make "userid" link to the glossary term.Karl O. Pinc
2014-08-12Security: Change "principal" argument in security.remember() to "userid".Karl O. Pinc
Make the change througout the authentication policies, etc. as well.
2014-08-12Docs: Make clear that a userid need not be a principal.Karl O. Pinc
2014-02-10- Garden PR #1121Steve Piercy
2013-10-27Security APIs on pyramid.request.RequestMatt Russell
The pyramid.security Authorization API function has_permission is made available on the request. The pyramid.security Authentication API functions are now available as properties (unauthenticated_userid, authenticated_userid, effective_principals) and methods (remember_userid, forget_userid) on pyramid.request.Request. Backwards compatibility: For each of the APIs moved to request method or property, the original API in the pyramid.security module proxies to the request. Reworked tests to check module level b/c wrappers call through to mixins for each API. Tests that check no reg on request now do the right thing. Use a response callback to set the request headers for forget_userid and remember_userid. Update docs. Attempt to improve a documentation section referencing the pyramid.security.has_permission function in docs/narr/resources.rst Ensures backwards compatiblity for `pyramid.security.forget` and `pyramid.security.remember`.
2013-10-19monChris McDonough
2013-10-19add admonishment against secret sharingChris McDonough
2013-04-05fix some cross-referencesTshepang Lekhonkhobe
2013-03-22remove unused ignore-next-block directiveTshepang Lekhonkhobe
2013-03-18reorder some imports to be alphabeticalMichael Merickel
2013-03-18support acl as a callableMichael Merickel
2013-03-13consistency: use $VENV whenever virtualenv binaries are usedTshepang Lekhonkhobe
2013-03-10Merge pull request #903 from tshepang/patch-4Tres Seaver
capitalize
2013-03-10Merge pull request #902 from tshepang/patch-3Tres Seaver
change awkward sentence
2013-03-10capitalizeTshepang Lekhonkhobe
2013-03-10change awkward sentenceTshepang Lekhonkhobe
2013-03-09grammarTshepang Lekhonkhobe
2012-11-04merged SHA512AuthTktAuthenticationPolicy into AuthTktAuthenticationPolicyMichael Merickel
AuthTktAuthenticationPolicy now accepts a hashalg parameter and is no longer deprecated. Docs recommend overriding hashalg and using 'sha512'.
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-27 19:49:12 +0000