The Mojo Mixins are there to make authentication and session managemeent easy in your application without having to load in the whole machinery in each request.
MojoAuthMixin is designed to override the get_current_user functionality of a standard Tornado RequestHandler to provide straightforward and secure authentication. Makes use of the SessionManager class to manage cookies.
The Auth mixin will make the get_current_user functionality available that takes advantage of the Mojo.Auth familly of modules and models.
Example Usage:
import tornado.web
from Mojo.RequestHandlers.MojoHandler import MojoRequestHandler
from Mojo.Auth.Mixins.MojoAuthMixin import MojoAuthMixin
from Mojo.Auth.models import User
from Mojo.Auth.Helpers import login_assistant
#To implement the mixin, simply subclass it alongside the regular MojoRequestHandler and the authentication
#funcitonality will be come available.
class loginHandler(MojoRequestHandler, MojoAuthMixin):
def get(self):
#Override the get function to render the page, check current_user to see if we're already logged in
if self.current_user:
self.render('login.html', error='ALREADY LOGGED IN')
else:
self.render('login.html', error=None)
def post(self):
#Get the username and password from the request
username = self.get_argument('username')
password = self.get_argument('password')
target = self.get_argument('next', '/admin/')
#Get the user from the database
thisUser = User.find_one({'username':username})
#Log the user in using the login assistant
if login_assistant(thisUser, password, self):
self.redirect(target)
else:
self.render('login.html', error='Login failed')
Overrides get_current_user to return the logged_in value from the sesison cookies. This function uses the SessionManager class to get and set cookies (this is to ensure that Mojo-specific functionality and keys are consistent).
Session mixins are designed to make persistent session management features from SessionManager available as part of your RequestHandler, the mixins enable getting and setting of persistent session data (sessions are stored in the database) and also nifty helper functions that wrap SessionManager.
The mixins come in two flavours: Synchronous and Asynchronous to ensure they work fully with your preferred database backend.
Synchronous Session Mixin RequestHandler base class. Exposes session management functions via a SessionManager object and ties these back using the ORM to the database, this mixin will use a blocking driver.
Usage:
from Mojo.Auth.Mixins.SessionMixins import SessionMixin_Sync
class loginHandler(MojoRequestHandler, SessionMixin_Sync):
def get(self):
...
Wrapper around the SessionManagers _create_new_session() method, but will save the session to DB instead of having to manage it manually.
Gets a session key from the database based on the session_id supplied by the RequestHandler. Similarly to set_session_key, this is not a cookie value, but a persistent session variable from the database.
Usage:
class loginHandler(MojoRequestHandler, SessionMixin_Sync):
def get(self):
this_session_value = self.get_session_key('test_value')
#Should render the 'test_value' session variable if it's in the template.
self.render('main.html', session_value=new_value)
Returns the whole session_model object and assigns it to itself.
Gets a user from the database, this is such a common operation it offers a quick and simple way to return the full user object from the database either by supplying the username or password.
Saves the session model to the database, in this case it’s a synchronous (blocking) operation. If there is no session to save, will create a new one (which is then saved automatically)
Session property - holds a SessionManager object that is initialised with the current RequestHandler as context, will initialise on first access.
Sets a session key and saves it to the database (not a cookie - sessions are identified by a session_id in the secure cookie collection and for security purposes are encoded and stored in the database so as not to leak any information).
Usage:
class loginHandler(MojoRequestHandler, SessionMixin_Sync):
def get(self):
self.set_session_key('test_value', 'hello world!')
new_value = self.get_session_key('test_value')
#Should render the 'test_value' session variable if it's in the template.
self.render('main.html', session_value=new_value)
Asynchronous Session Mixin RequestHandler base class. Exposes session management functions via a SessionManager object and ties these back using the ORM to the database, this mixin will use a non-blocking driver.
Is compatible with gen.Task or callback-style implementations, the preferred method is the gen.Task implementation.
Usage:
from Mojo.Auth.Mixins.SessionMixins import SessionMixin_Async
class loginHandler(MojoRequestHandler, SessionMixin_Async):
@tornado.web.asynchronous
@gen.engine
def get(self):
...
Wrapper around the SessionManagers _create_new_session() method, but will save the session to DB instead of having to manage it manually.
Gets a session key from the database based on the session_id supplied by the RequestHandler. Similarly to set_session_key, this is not a cookie value, but a persistent session variable from the database.
Usage:
class loginHandler(MojoRequestHandler, SessionMixin_Sync):
@tornado.web.asynchronous
@gen.engine
def get(self):
new_value = yield gen.Task(self.get_session_key,'test_value')
#Should render the 'test_value' session variable if it's in the template.
self.render('main.html', session_value=new_value)
Returns the whole session_model object and assigns it to itself.
Gets a user from the database, this is such a common operation it offers a quick and simple way to return the full user object from the database either by supplying the username or password.
Saves the session model to the database, in this case it’s an asynchronous (non-blocking) operation. If there is no session to save, will create a new one (which is then saved automatically)
Session property - holds a SessionManager object that is initialised with the current RequestHandler as context, will initialise on first access.
Sets a session key and saves it to the database (not a cookie - sessions are identified by a session_id in the secure cookie collection and for security purposes are encoded and stored in the database so as not to leak any information).
Usage:
class loginHandler(MojoRequestHandler, SessionMixin_Async):
@tornado.web.asynchronous
@gen.engine
def get(self):
yield gen.Task(self.set_session_key,'test_value', 'hello world!')
new_value = yield gen.Task(self.get_session_key,'test_value')
#Should render the 'test_value' session variable if it's in the template.
self.render('main.html', session_value=new_value)