private projects - authentication w/ RSS feeds incompatible with RSS aggregators #5

Open
peterleonard opened this Issue Mar 13, 2010 · 1 comment

1 participant

@peterleonard

Requiring authenticated cookies to retrieve RSS feeds for private projects is incompatible with most RSS aggregators. For example, using Yahoo, Netvibes, or Google Reader doesn't work with private projects. There is, however, a desire for a public RSS feed for an otherwise-private project.

It's a common problem, and is handled elsewhere (e.g. Google Calendars) by adding an identifier and cryptographic checksum to the URL string, and using that as validation instead. For example:

sitename.com/port/app/projects/feeds/PROJECTID/USERID/crypto_string

where crypto_string could be something like the md5sum of PROJECT_ID, USERID and some secret key.

Thoughts?

Other note is that any FORBIDDEN message relating to RSS feeds should be sent as an RSS feed and not as an HTML page.

@peterleonard

Is it better to open up tickets on the CPAN side of things, rather than here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment