Ability to instantiate the API via a session id#77
Ability to instantiate the API via a session id#77manneohrstrom wants to merge 14 commits intomasterfrom
Conversation
If a shotgun API instance is constructed using a username/password combination, a session token is requested from the server and this session token is used instead of the username/password to authenticate for the remainder of the session. Furthermore, the password member variable is cleared, meaning that there is no password string persisting in memory during the lifetime of the API instance.
This reverts commit b2ae8ff.
Note that this change requires the modified shotgun API here: shotgunsoftware/python-api#77
This makes it easier to create new shotgun API instances based on the same proxy settings as another instance.
This is raised whenever a session id fails to authenticate.
There was a problem hiding this comment.
This could use a comment as to how it could be used. Since it isn't used in the API itself it isn't obvious.
There was a problem hiding this comment.
heh, initially i had a comment but removed it given the coding style. It's back now! :)
There was a problem hiding this comment.
That feels less fragile. Only thing I'd say is to comment on that 102 to say where it comes from. Otherwise it is just a magic number.
|
You reverted your commit where you cleared the username/password after authenticating. Why? Is it just performance? Or it is because it's not part of our current mandate? |
|
I reverted the commit about the username/password because there is a subtle regression which makes it trickier to deal with than I first thought: If you have a shotgun session which was instantiated with a login/password, this session is currently operational forever, because it keeps sending the username and password back to the server. It is, however, storing the password as a member variable, which is not good practice. If we dropped the password at construction time and instead continued with a session token, the API session wouldn't be valid forever anymore -- if you left it idle for 24 hours and then picked it back up again it would raise an |
|
Gotcha. Totally makes sense. |
Adds a constructor parameter session_token which makes it possible to create an API instance without either username/password or script/script key. A session token can be generated via the new get_session_token() method. Closes #77
|
this is now merged into the toolkit security branch. |
3 participants
Adds a constructor parameter
session_tokenwhich makes it possible to create an API instance without either username/password or script/script key.A session token can be generated via the new
generate_session_token()method.