websocket - How to limit Autobahn python subscriptions on a per session basis -

I am using autobahnpithon on the server side and autobanges in the browser with twists and turns (vamps). Is there a straightforward way to allow / restrict membership on a per session basis? For example, a customer should not be able to subscribe to topics related to other users.

When I'm not using crossbar.io, I finally tried to use the Python code shown in the 'Examples' section An RPC call on this page was first authorized by a customer Is used to give. Of course, I am using my authorization logic. Once this Authority is successful, I want to give clients' exclusive privileges only to subscribe to related topics related to this client, like 'com.example.user_id' my problem This is that if auth passes, however, I have not found any way to limit membership requests in the AdSense session where the authorization occurs. Which client can I authorize to subscribe to 'com.example.user_b' with user_id = user_a?

You can authorize your own router by doing so, subclass router () and override (On a minumum) Authorized () method:

  def authorize (self, session, yuri, action): back true  

this method is very simple , If you return the truth, the session has the right to do what he is trying to do. You can create a rule that all subscriptions must start with 'com.example.USER_ID', so your Pyro code will split Yuri, take the third field, and compare it to the current session ID, if they are wrong otherwise . This is where things are a little weird, though. I have a code that does the same thing, here is my authorization () method:

  @inline callback def authorized (self, session, yuri, verb): authid = session._authid if any The author is not auth: Authid = 1 log.msg ("AuthorizeRouter.authorize: {} {} {} {} {}". Format (author, session._sian_id, yuri, ii oater.action_t_STRING [action], action)) If the author ! = 1: RV = Yield itself. Check_primation (authid, uri, IRouter.ACTION_TO_STRING [verb]): rv = yield True log.msg ("AuthorizeRouter.authorize: rv {}". Format (RV)) if not uri.startswith (Self.svar [' Topic_base ']): self.sessiondb.activity (session._session_id, uri, IRouter.ACTION_TO_STRING [action], RV) Return Value (RV) Return  

Note that I get _authid I take a dip in the session, which is bad karma (I think) because I should not see these private variables. I do not know where and where to get it.

In addition, the note goes hand in hand with this authentication. In my implementation, _authid is a certified user id, which is similar to a UNIX user id (positive unique integer). I am pretty sure that this can be anything like string, so if you want you should be okay with your 'user_b' as _auth_id.

-g