When a user logs in you want to clear the SESSION object related to his browser. The simplest way to do this is to use a cookie-based user folder and cause the session to be cleared as a result of the user submitting a login form (read the Sessions chapter and look for "invalidate" to see how to clear the session). The stock Zope user folder uses basic HTTP authentication and is therefore not suitable for this purpose. This is an unfortunate limitation of basic authentication. Basic HTTP authentication is not suitable because there is no way to "hook" a login (the programmer never gets the chance to "do something" when a user logs in). OTOH, cookie-based user folders are suitable for this purpose because typically you will have the chance to display a custom login form and process its results yourself. During this processing, on successful login, invalidate the session object, and you'll have solved your problem. For a list of user management-related Products, many of which are user folder implementations that you might be able to use, consult http://www.zope.org/Products/user_management . On Mon, 2002-09-09 at 12:18, Stacy Roberts Ladnier wrote:

I know the session was created for this reason. However, when storing parameters in the session, we experience problems when a user switches login names in the same browser session. Parameters that exist under one user name are persisted over to the new user name and this should not be allowed to happen. When it does, certain options the user can choose, will cause the search mechanism to completely crash and write null values to the database. This then prevents the user from using our site until we detect the Null value and delete it. As you can imagine, this is a MAJOR problem that has to be avoided at all costs. When parameters are passed in the REQUEST object, this problem is resolved.

Right now, we recreate the REQUEST object in each page. This becomes code intensive and a management nightmare. When one parameter is added, every single page must be touched. I would love to use the session, but the resulting problems prevent me from utilizing it. I need a way to persist the parameters throughout my search capabilities, but wipe the slate clean when a user logs in as a different user. I tried this out with the session, but a new session is not created unless I open a new browser instance and then log in in this new instance.

If I can find a way to force a new SESSION object to start when a user clicks a certain link, my problem may be solved. I know I ABSOLUTELY want to avoid passing 50 parameters in the URL string. That is so UGLY.

You mention that I can, in fact, remove the arguments from the session. Can you please explain how I can do this in detail? I want the transition to ZOPE to bring about some valuable improvements to our site and the maintenace of our code.

Stacy

Heimo Laukkanen wrote:

...

Subject: Re: [Zope] REQUEST parameters needed throughout website Cc: zope@zope.org To: "Stacy Roberts Ladnier" <Stacy.Roberts@noaa.gov> From: Jens Vagelpohl <jens@zope.com>

...

user's search. I DO NOT want to use the session to store the parameters in because this will cause problems if a certain course of action is taken. ... Please understand I am very new to Zope. My company is trying to transition from Java and JSP to Zope and Python. I need to make sure

Since you say: a) you are new to Zope b) you don't want to use sessions c) you need to do something that is exactly what sessions are for,

I'll have to ask - what are the conditions and the course of action that makes sessions cause problems? And whatkind of problems they are - and is the reason for these problems sessions or something else?

And as a reminder:

1) HTTP is a sessionless protocol - there is no such thing as a session in the protocoll

2) Passing variables or arguments happens usually either in the URL ( http://xx.xx.xx?foo=bar&dinner=spam ),as a form field or in a cookie.

3) Since passing multiple arguments all the time is stupid - systems for storing the data with a session key have been developed to practicly all the web development platform. Instead of passing all the arguments you just pass the session key. And then the session key gives you access to all your arguments. And when you are done, you can just remove the arguments or kill the session.

Now. Is the session mechanism really the problem?

-huima

Stacy Roberts Ladnier wrote:

If I can find a way to force a new SESSION object to start when a user clicks a certain link, my problem may be solved. I know I ABSOLUTELY want to avoid passing 50 parameters in the URL string. That is so UGLY.

You mention that I can, in fact, remove the arguments from the session. Can you please explain how I can do this in detail? I want the transition to ZOPE to bring about some valuable improvements to our site and the maintenace of our code.

Zope Book is you friend. Using sessions gives you basic view of how to handle sessions: http://www.zope.org/Documentation/Books/ZopeBook/current/BasicObject.stx Then check out the Session API and TransienceIntefaces: http://www.zope.org/Documentation/Books/ZopeBook/current/AppendixB.stx Here are three lines of Python Script from the example in Zope Book appendix B: l=SESSION['myList'] l.append('spam') SESSION['myList']=l Hope this helps. Now combine this information with the information from Chris McDonough's email you should have a solution. And then we see a great wisdom. If in the first place people would describe better their problem, rather than how they can put cubic XYZs into round holes -- if that is not exactly the problem, people would definitely get better answers fasters ,--) And / If you still more problems, please do not hesitate to ask. -huima