timetric / django-oauth

Forked version of David Larlet's django-oauth, with some important changes; see the README

This URL has Read+Write access

name age
history
message
file .gitignore Tue Sep 16 03:28:04 -0700 2008 Reorganisation of source files. [Dan Wilson]
file AUTHORS Wed May 27 06:24:22 -0700 2009 Add a README file explaining use of the caching... [Toby White]
file LICENSE Wed Jan 28 06:52:06 -0800 2009 Switched to David Larlet's LICENSE/AUTHORS [Dan Wilson]
file README Wed Sep 16 14:17:11 -0700 2009 Extend README to note backward-incompatible cha... [tow]
file __init__.py Mon Sep 22 08:55:26 -0700 2008 Added __init__.py file [Dan Wilson]
file admin.py Wed Jan 28 05:02:52 -0800 2009 Misc other changes based on David's code [Dan Wilson]
file decorators.py Fri Sep 04 07:37:12 -0700 2009 In oauth_required decorator, attach the user & ... [tow]
file forms.py Wed Jan 28 06:42:43 -0800 2009 Added two optional fields on the Consumer model... [Dan Wilson]
file managers.py Mon Sep 07 07:20:39 -0700 2009 Move all constants out of consts.py to models.p... [tow]
file models.py Sun Sep 13 04:15:38 -0700 2009 We don't need a special URL field in the db [tow]
file oauth.py Sat Sep 19 07:34:02 -0700 2009 Add tweak to oauth.py to permit switching off t... [tow]
file stores.py Tue Sep 29 14:59:08 -0700 2009 Be laxer about validity of callback urls; allow... [tow]
file tests.py Mon Sep 07 07:20:39 -0700 2009 Move all constants out of consts.py to models.p... [tow]
file urls.py Tue Nov 18 03:36:12 -0800 2008 Added a revoke token view [Dan Wilson]
file utils.py Sat Sep 19 07:34:02 -0700 2009 Add tweak to oauth.py to permit switching off t... [tow]
file views.py Sun Sep 13 04:38:48 -0700 2009 Check callback URL for 1.0 transactions [tow]
README
This is a forked version of David Larlet's django-oauth.

One very important difference is that this version requires that you be running a real cache behind Django's caching 
framework: http://docs.djangoproject.com/en/dev/topics/cache/

The cache is used for keeping track of nonces and making sure that none are duplicated within a short period of time, so 
a cache backend with automatic expiry is required. Memcached is known to work, other backends are untested.

If you run with a dummy cache, django-oauth will operate without complaint, but you will lose all protection against 
replay attacks. You should only do this in testing environments.

Also there are a couple of backward-incompatible changes from the upstream version.

* This version has a different db schema - additional fields on the Token model.

* This version changes the signature of the OAUTH_CALLBACK_VIEW callable

Toby White, Inkling Software
2009-09-16