My Zope server uses exUserFolder and PostgreSQL for authentication. I turned on query logging today for unrelated reasons, and noticed an almost continuous stream of queries: SELECT * FROM passwd where upper(username)=upper('kirk') SELECT * FROM passwd where upper(username)=upper('kirk') SELECT * FROM passwd where upper(username)=upper('kirk') SELECT * FROM passwd where upper(username)=upper('kirk') where "kirk" is my own username. The problem was that I wasn't logged in at the time. I traced the problem back to our main page template, which starts with: <head> <title>Example.com : <span tal:replace="template/title_or_id">Page Title</span></title> </head> Being curious, I changed my username in the PostgreSQL table to "kirk_foo", and watched as my logfiles began filling with 401 errors with backtraces like: Time 2006/03/23 13:46:38.832 US/Central User Name (User Id) ourcustomer (ourcustomer) Request URL http://www.example.com/invoices/index_html Exception Type Unauthorized Exception Value You are not allowed to access 'title_or_id' in this context as customers get messages like: Site Error An error was encountered while publishing this resource. Error Type: Unauthorized Error Value: You are not allowed to access 'title_or_id' in this context Now, "ourcustomer" has full rights to the "invoices" folder and all files in it, but they can't execute the "title_or_id" method on objects inside. Also, how on Earth did my username get dragged into this? As the main site developer, I own all the objects in the site, but I don't have any odd Proxy access set up. I can't figure out why customers are trying to call title_or_id as me in the first place, let alone why it fails. Any insight? -- Kirk Strauser The Day Companies
+-------[ Kirk Strauser ]---------------------- | My Zope server uses exUserFolder and PostgreSQL for authentication. I | turned on query logging today for unrelated reasons, and noticed an almost | continuous stream of queries: [snip] | Now, "ourcustomer" has full rights to the "invoices" folder and all files | in it, but they can't execute the "title_or_id" method on objects inside. | Also, how on Earth did my username get dragged into this? As the main site | developer, I own all the objects in the site, but I don't have any odd Proxy | access set up. I can't figure out why customers are trying to call | title_or_id as me in the first place, let alone why it fails. Any insight? Every TAL call pretty much creates a new security context, which is why it's hitting the DB so often (this is why it's best to turn on caching in XUF even for 5 or 10 seconds if you're using a 'slow' auth mechanism). I'm not sure why it's using your username and not their own though, without actually looking at your setup. XUF just executes the lookups based on what Zope tells it to do. -- Andrew Milton akm@theinternet.com.au
On Thursday 23 March 2006 21:24, Andrew Milton wrote:
Every TAL call pretty much creates a new security context, which is why it's hitting the DB so often (this is why it's best to turn on caching in XUF even for 5 or 10 seconds if you're using a 'slow' auth mechanism).
In the "Paramaters" tab in my XUF acl_users folder, I have: Credential Cache Timeout in Seconds (0 for No Caching) : 30 Negative Credential Cache Timeout in Seconds (0 for No Caching): 5 and yet I'm still seeing several identical queries per second in my database logs. Shouldn't those settings enable the cache?
I'm not sure why it's using your username and not their own though, without actually looking at your setup. XUF just executes the lookups based on what Zope tells it to do.
Thanks. I'll look into VerboseSecurity to see if I can figure out why it really, really wants to auth as me. -- Kirk Strauser The Day Companies
+-------[ Kirk Strauser ]---------------------- | On Thursday 23 March 2006 21:24, Andrew Milton wrote: | | > Every TAL call pretty much creates a new security context, which is why | > it's hitting the DB so often (this is why it's best to turn on caching in | > XUF even for 5 or 10 seconds if you're using a 'slow' auth mechanism). | | In the "Paramaters" tab in my XUF acl_users folder, I have: | | Credential Cache Timeout in Seconds (0 for No Caching) : 30 | Negative Credential Cache Timeout in Seconds (0 for No Caching): 5 | | and yet I'm still seeing several identical queries per second in my database | logs. Shouldn't those settings enable the cache? Yes, but, only if you're successfully logged in... Negative cache prevents lookups on previously known bad users.. -- Andrew Milton akm@theinternet.com.au
participants (2)
-
Andrew Milton -
Kirk Strauser