gws.plugin.auth_method.web.core

The web authentication method and its API types.

Source code: gws.plugin.auth_method.web.core

Module Contents

class gws.plugin.auth_method.web.core.Config

Bases: gws.base.auth.method.Config

Authentication with a login form and a session cookie.

cookieName: str = 'auth'

Name of the session cookie.

cookiePath: str = '/'

Path attribute of the session cookie.

cookieSameSite: str = 'Lax'

SameSite attribute of the session cookie.

loginRedirect: LoginRedirectRule | None

Redirect denied page requests to a login page.

class gws.plugin.auth_method.web.core.LoginRedirectRule(*args, **kwargs)

Bases: gws.Data

Redirect to a login page for page requests that are denied.

pattern: gws.Regex | None

Regular expression for URLs to redirect.

target: str

Login page URL.

class gws.plugin.auth_method.web.core.LoginRequest(*args, **kwargs)

Bases: gws.Request

Login request.

password: str

Password.

to: str | None

URL path to return to after the login.

username: str

Login name.

class gws.plugin.auth_method.web.core.LoginResponse(*args, **kwargs)

Bases: gws.Response

Response to a login or multi-factor request.

mfaCanRestart: bool = False

The multi-factor transaction can be restarted.

mfaMessage: str = ''

Message for the user in the multi-factor step.

mfaState: gws.AuthMultiFactorState | None

State of the multi-factor transaction, if there is one.

redirectTo: str = ''

URL path to go to after a completed login, empty if none.

user: gws.base.auth.user.Props | None

Properties of the logged-in user, set when the login is completed without a second step.

class gws.plugin.auth_method.web.core.LogoutResponse(*args, **kwargs)

Bases: gws.Response

Response to a logout request.

class gws.plugin.auth_method.web.core.MfaVerifyRequest(*args, **kwargs)

Bases: gws.Request

Request to verify a multi-factor code.

payload: dict

Data entered by the user, for example {"code": "123456"}.

to: str | None

URL path to return to after the login.

class gws.plugin.auth_method.web.core.Object

Bases: gws.base.auth.method.Object

Web authentication method.

Authenticates users with a login form and keeps their sessions in the session manager, identified by a session cookie. Handles logins, logouts and multi-factor verification for the auth action.

cookieName: str

Name of the session cookie.

cookiePath: str

Path attribute of the session cookie.

cookieSameSite: str

SameSite attribute of the session cookie.

deletedSession: gws.base.auth.session.Object

Placeholder session for requests with an invalid session cookie.

loginRedirect: LoginRedirectRule | None

Redirect rule for denied page requests, or None.

activate()
close_session(req, res)
configure()
exit_middleware(req, res)
handle_login(req: gws.WebRequester, p: LoginRequest) → LoginResponse

Log in with a username and a password.

The credentials are checked by the authentication providers. If the user has an mfaUid, a multi-factor transaction is started and kept in a new guest session; handle_mfa_verify completes the login. Otherwise the current session is replaced by a new session for the user.

Parameters:

  • req – Web requester.

  • p – Login request.

Returns:

The user and the redirect target, or the multi-factor state.

Raises:

  • gws.ForbiddenError – If the user is already logged in, the method is secure and the request is not, or the multi-factor transaction cannot be started.

  • gws.AuthenticationError – If the credentials are not accepted.

handle_logout(req: gws.WebRequester) → LogoutResponse

Log out the current user and delete the session.

Parameters:

req – Web requester.

Returns:

An empty response.

Raises:

gws.ForbiddenError – If the session was opened by a different method.

handle_mfa_restart(req: gws.WebRequester, p: gws.Request) → LoginResponse

Restart the multi-factor transaction of the current session.

Parameters:

  • req – Web requester.

  • p – Request parameters.

Returns:

The state of the new transaction.

Raises:

gws.ForbiddenError – If the session has no valid transaction or it cannot be restarted. The session is deleted in this case.

handle_mfa_verify(req: gws.WebRequester, p: MfaVerifyRequest) → LoginResponse

Verify a multi-factor payload.

On success, the session is replaced by a new session for the user. If the adapter allows another attempt, the transaction is kept. Otherwise the session is deleted.

Parameters:

  • req – Web requester.

  • p – Verification request.

Returns:

The multi-factor state, with the redirect target on success.

Raises:
open_session(req)
class gws.plugin.auth_method.web.core.UserResponse(*args, **kwargs)

Bases: gws.Response

Response with the current user.

user: gws.base.auth.user.Props | None

Properties of the user, None for guests.