Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles.

Of course, I need to authenticate and authorizate. I wanted to simply ask username and password. My college asked me why not to take login data from file. I answered that I don't want to save password in plain-text. He told me to use tokens!

So how to do it? I understand that I need to generate random token for user and knowing it will allow anyone to login. It should be really strong and random so nobody can guess it. Is there something else? Will it be safe to save it in text file?

I would like to hear how would you implement it in the simplest possible yet secure way. Some links to literature would be good too!

share|improve this question

migrated from stackoverflow.com Jan 14 '13 at 22:12

This question came from our site for professional and enthusiast programmers.

    
Maybe OAuth is best solution for you? It's somewhat complex, but it's standard, it's flexible, and there is ready solutions. –  cleg Jan 14 '13 at 13:12
    
You write about "complex". I can't believe that it's simplest yet secure solution out there. I'm looking not so much for solution, but for explanation how and why. Thanks for you answer anyway! –  daGrevis Jan 14 '13 at 13:25
    
I've added a link because OAuth begguiner's guide contains nice introduction with description of problems scope, etc. oauth.net/documentation/getting-started –  cleg Jan 14 '13 at 13:29
1  
Two out-of-the-box ideas here, both in the "Do One Thing Right" realm. One: ssh-mount the website's data directory locally and just edit files as if they were local (this, of course, only works if you have a filesystem-based backend). Two: install the It's All Text extension for Firefox, configure it to use vim, log into the CMS, select the textbox, activate It's All Text, voila, vim is now your editor. –  tdammers Jan 14 '13 at 22:26
add comment

2 Answers

up vote 1 down vote accepted

I understand that you are the only person (or one of very few) to use this mechanism:

if you want to authenticate other users of your webapp, then refer to @Martin's answer, otherwise:

your token is technically called a shared secret. It works and it is secure (as long as the secret is not shared to the outside world, like e.g. readable from the web, etc.).
saving it in a text-file is secure if the storage is secure.

another very simple way would be basic auth. it should be sent over ssl, though. see this question for some further discussion on its security implications.

share|improve this answer
add comment

Although you still need a way to authenticate your user the first time (against a hashed password) you can then set a secure cookie that will prove your user is the same one still.

To do this securely, you need a server-side secret, and cookie values that have the time of creation, the username, and that secret hashed together, so that when your user returns for the next HTTP connection you can a) retrieve the username, and b) verify the cookie is still valid and secure.

This is what the mod_auth_tkt Apache module implements, as well as the Pyramid AuthTktAuthenticationPolicy class and the plone.app.session package.

You could take a look through the source code of the latter two to see what they do to create and verify these cookies:

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.