1

I have implemented a very small application with Tornado, where HTTP GET Requests are used to perform actions. Now I would like to secure these requests. What would be a preferable way? Using .htaccess? How can I realize that?

It doesn't have to be for certain requests, it should be for all requests running on a certain port.

3
  • What exactly do you mean by secure? You can configure Apache2 to do things like this, but your app written in tornado should be the one looking up permissions Dec 9, 2012 at 18:09
  • @JonClements Looking up permissions? What do you mean, should I simply send let's say login name and password with a HTTPS?
    – Mahoni
    Dec 9, 2012 at 18:11
  • Normally you let the app that's being used check authorisation - however, I'm now thinking you just mean authentication... there's a distinct difference Dec 9, 2012 at 18:18

2 Answers 2

2

If you based your application on the Tornado "Hello World" example then you probably haven't, but you really should consider writing your application as a WSGI application. Tornado has no problem with that, and the advantage is that your application now will run under a multitude of other environments (Apache + mod_wsgi to name but one).

But how does that solve your original problem? Well, just Google "WSGI authentication middleware", it'll yield plenty of hits. Basically, what that entails is transparently 'wrapping' your WSGI-application in another, one allowing you to completely decouple that aspect of your application. If you're lucky, and one of hits turns out to be a perfect fit, you might get away with not witing any extra code at all.

Since you mentioned .htaccess: it is possible to have Apache do the authentication in an Apache/mod_wsgi configuration.

1
  • If you are using Tornado, then, there is no point of using Apache as a server with the blocking mod_wsgi wrapper, you should go for Nginx which plays well in terms of concurrency. Otherwise, you are not utilizing the real power of Tornado's concurrency and non-blocking features. Dec 30, 2012 at 7:50
1

.htaccess files are not supported by Tornado as far as I know. Look into setting up basic authentication on Tornado. Something like this: https://gist.github.com/660185 is probably what you want. You'll need to store your own user credentials however as Tornado has no baked in support for that as apache does with .htaccess files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.