[Zope-CVS] CVS: Products/CookieCrumbler - CHANGES.txt:1.5 CookieCrumbler.py:1.7

Chris McDonough chrism@zope.com
Fri, 24 May 2002 12:12:52 -0400


Update of /cvs-repository/Products/CookieCrumbler
In directory cvs.zope.org:/tmp/cvs-serv4359

Modified Files:
	CHANGES.txt CookieCrumbler.py 
Log Message:
Caused CookieCrumbler to set "Cache-Control: no-cache" headers for responses
which use its services.

The purpose of this is to cause upstream caches to not cache pages that
may have elements which are customized due to cookie authentication.
To do otherwise would be a security risk.


=== Products/CookieCrumbler/CHANGES.txt 1.4 => 1.5 ===
 - Made sure inner cookie crumblers can override the logout form.
 
+Unreleased
+
+- A "Cache-Control: no-cache" header is now sent along in responses
+  that employ cookie auth to avoid potential security issues with
+  public caches serving stored "authorized" pages.


=== Products/CookieCrumbler/CookieCrumbler.py 1.6 => 1.7 ===
 import Globals
 from Globals import HTMLFile
-from zLOG import LOG, ERROR
+from zLOG import LOG, ERROR, BLATHER
 from App.Common import package_home
 from ZPublisher.HTTPRequest import HTTPRequest
 from OFS.DTMLMethod import addDTMLMethod
@@ -251,20 +251,34 @@
 
     def __call__(self, container, req):
         '''The __before_publishing_traverse__ hook.'''
+        LOG('CookieCrumbler', BLATHER, '__call__: invoked')
         resp = self.REQUEST['RESPONSE']
         attempt = self.modifyRequest(req, resp)
         if attempt == ATTEMPT_DISABLED:
+            LOG('CookieCrumbler', BLATHER,
+                '__call__: attempt == ATTEMPT_DISABLED')
             return
         if not req.get('disable_cookie_login__', 0):
+            LOG('CookieCrumbler', BLATHER,
+                '__call__: not req.get("disable_cookie_login__")')
             if (self.redir_always or
                 attempt == ATTEMPT_LOGIN or attempt == ATTEMPT_NONE):
+                LOG('CookieCrumbler', BLATHER, ('__call__: '
+                    'self.redir_always or attempt == ATTEMPT_LOGIN or attempt '
+                    '== ATTEMPT_NONE'))
                 # Modify the "unauthorized" response.
                 req._hold(ResponseCleanup(resp))
                 resp.unauthorized = self.unauthorized
                 resp._unauthorized = self._unauthorized
         if attempt != ATTEMPT_NONE:
+            LOG('CookieCrumbler',BLATHER,('__call__: attempt != ATTEMPT_NONE'))
+            # we don't want caches to cache the resulting page
+            resp.setHeader('Cache-Control', 'no-cache')
+            # demystify this in the response.
+            resp.setHeader('X-Cache-Control-Hdr-Modified-By', 'CookieCrumbler')
             phys_path = self.getPhysicalPath()
             if self.logout_page:
+                LOG('CookieCrumbler',BLATHER,('__call__: self.logout_page'))
                 # Cookies are in use.
                 page = getattr(container, self.logout_page, None)
                 if page is not None: