You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by "Jukka Zitting (JIRA)" <ji...@apache.org> on 2011/01/20 18:18:43 UTC
[jira] Created: (JCR-2867) Read-only session
Read-only session
-----------------
Key: JCR-2867
URL: https://issues.apache.org/jira/browse/JCR-2867
Project: Jackrabbit Content Repository
Issue Type: New Feature
Components: jackrabbit-core
Reporter: Jukka Zitting
It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "angela (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984364#action_12984364 ]
angela commented on JCR-2867:
-----------------------------
> Aren't you supposed to use a read-only user in that case? Like anonymous?
anonymous isn't necessarily a read-only user, and isn't necessarily a user that can-read-everything. that's just the
case in the simple-security-setup in jackrabbit.
the suggestion here - as far as i am concerned - was to be allow to indicate that given session would
never make any attempt to write: it was a read-only-Session which isn't the same thing as creating a
session for a user that doesn't have any write-permission, nowhere at all.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "angela (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984292#action_12984292 ]
angela commented on JCR-2867:
-----------------------------
> This could be implemented for example as a per-session flag that could be set through an
> extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
uh :) why not making use of the attributes that can be set with the SimpleCredentials?
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "Alexander Klimetschek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984360#action_12984360 ]
Alexander Klimetschek commented on JCR-2867:
--------------------------------------------
Aren't you supposed to use a read-only user in that case? Like anonymous?
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "Alexander Klimetschek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984370#action_12984370 ]
Alexander Klimetschek commented on JCR-2867:
--------------------------------------------
> anonymous isn't necessarily a read-only user, and isn't necessarily a user that can-read-everything
Yes, but isn't it the job of the repository to do that? Implementing such a thing on the application level, and saying "the request will never write", is something that won't work in the long run. For example, if you have the common model in Sling, where a session is automatically created for a request, based on authentication, you don't know if it is going to be read-only.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "Jukka Zitting (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984363#action_12984363 ]
Jukka Zitting commented on JCR-2867:
------------------------------------
Good point about a credentials attribute! It's much better than my idea.
Re: anonymous user; You might still want this session to have read access to content that may otherwise be protected.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Issue Comment Edited: (JCR-2867) Read-only session
Posted by "angela (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984739#action_12984739 ]
angela edited comment on JCR-2867 at 1/21/11 9:07 AM:
------------------------------------------------------
> My idea here is that you could use this mechanism to enforce high-level constraints like "no writes on GET"...
and my idea was when we discussed that half a year ago that having such a session would allow to
prevent unintended write operations in cases where they should never occur by design... currently there is
just now way to prevent that, exception from being careful and keeping an eye on the code.
was (Author: anchela):
> My idea here is that you could use this mechanism to enforce high-level constraints like "no writes on GET"...
and my idea was when we discussed that half a year ago that having such a session would allow to
prevent unintended write operations in cases where they should occur by design... currently there is
just now way to prevent that, exception from being careful and keeping an eye on the code.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "angela (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984290#action_12984290 ]
angela commented on JCR-2867:
-----------------------------
> It would be nice to have a way to declare that a given JCR session ...
this would also be very useful for the SystemSessions. In many conditions they are used for read-only access to
the repository but there is not way to enforce it... as long as a single developer operates on the code and remembers
the original aim this works fine... but i would have wished many times, that i could explicitly get a read-only system
session making sure that it really isn't used for writing.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "angela (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984739#action_12984739 ]
angela commented on JCR-2867:
-----------------------------
> My idea here is that you could use this mechanism to enforce high-level constraints like "no writes on GET"...
and my idea was when we discussed that half a year ago that having such a session would allow to
prevent unintended write operations in cases where they should occur by design... currently there is
just now way to prevent that, exception from being careful and keeping an eye on the code.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "Jukka Zitting (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984380#action_12984380 ]
Jukka Zitting commented on JCR-2867:
------------------------------------
My idea here is that you could use this mechanism to enforce high-level constraints like "no writes on GET". This is orthogonal to normal access rights and is typically hard to control otherwise when you're dealing with potentially buggy components that you don't have direct control over.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (JCR-2867) Read-only session
Posted by "Alexander Klimetschek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JCR-2867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12984404#action_12984404 ]
Alexander Klimetschek commented on JCR-2867:
--------------------------------------------
> "no writes on GET". This is orthogonal to normal access rights
Ok, I see your point.
> Read-only session
> -----------------
>
> Key: JCR-2867
> URL: https://issues.apache.org/jira/browse/JCR-2867
> Project: Jackrabbit Content Repository
> Issue Type: New Feature
> Components: jackrabbit-core
> Reporter: Jukka Zitting
>
> It would be nice to have a way to declare that a given JCR session will only be used for reading, regardless of the access rights of the logged in user. This would be useful for example in web applications that want to enforce constraints like allowing no writes during processing of GET requests.
> This could be implemented for example as a per-session flag that could be set through an extra parameter in the login() call, like this: repository.login("workspace-name?readonly", credentials);
> Alternatively a security manager could be connected with a ThreadLocal variable set for example by a servlet filter based on the current request method.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.