[Zope] no-login account for local users

Chris Withers chris at simplistix.co.uk
Thu Feb 10 07:01:13 EST 2005


Dieter Maurer wrote:
> The stock Zope "UserFolder" has such a feature.
> However, it is disabled (for security reasons -- it is not
> too difficult to fake an IP address).

I believe it's actually for scalabiltiy reasons.
The way IP auth is implemented by default is appallingly slow and 
affects all requests if it's enabled, even if no users are actually 
using IP auth.

cheers,

Chris

-- 
Simplistix - Content Management, Zope & Python Consulting
            - http://www.simplistix.co.uk


More information about the Zope mailing list