From: John Miller Date: 2007-04-06T07:08:29+09:00 Subject: Re: XMLRPC Ruby 1.8.6 stdlib Authentication/docs Follow Up Inline Greetings again, I'm posting this here as a follow up with what I've learned. Too many threads on this list never get resolved and the original poster never come back with the results. Below is as much as I've been able to gather on the answers to my questions. > I am writing a Rails App which includes (I hope) an XMLRPC API > interface. I am working with the XMLRPC library in Ruby 1.8.6 to write > a client and a Mock of the Rails server. In looking at the code in the > Lib I have a few questions. While I've seen nothing official it is rumored (http://www.ruby-forum.com/topic/69519#91675) that AWS is leaving rails so I'm thinking that I can use the stdlib to role moy own with more flexibility. > First, the documentation is sketchy in the client and server classes and > non-existent in the the supporting files. I've made notes in my local > copy and would be happy to share them, if they would be appreciated. > There seems to be a lot of hidden functionality that is not documented. Thanks for the feedback. I will clean this up a bit ans submit a patch to Ruby-doc. > Next, I need to authenticate the user, and there seem to be a number of > different ways to do this: HTTP Authentication, Cookies, or within the > RPC it's self. This last is the one used in the two examples that come > with Rails, but I consider it suboptimal. What is required for the > other two? I read this: http://www.ruby-forum.com/topic/81539#140475 > but I'm not clear on how the user information makes it from the caller > to my RPC function. I've looked onto this and I think that I am happier sending Username and Session ID as part of the the request body. Current implementation not withstanding, there is nothing in the XMLRPC standard the requires that HTTP be used as the communications channel. Even if that is the channel of communication, there is no requirement that the client or server handle specifics. Both HTTP Authentication and Cookies are optional parts of the HTTP standard, (as is seen with my cookie question below.) > With stand alone XMLRPC server, is it possible to see the original HTTP > request object from within the handler block? Short answer is no. The long answer is that the handler should not anticipate having any HTTP Request as that is not required. On the other hand the code that extracts the XML data out of the post does have access to this data. Ideally all information should be in the body of the message, but it is possible to modify the message with things like authentication information before passing it on to the handler code. > Finally, in client.rb lines 565 and 566 appear to handle cookies in a > very non-standard way: > > c = resp["Set-Cookie"] > @cookie = c if c > > It looks to me like having the server set a new cookie simply replaces > all the existing cookies. My initial guess is that this was a hack to > make secessions work under Rails without having to completely support > cookies. Can anyone shed some light here? I will be sure to note this in the documentation I submit, If time allows I think I also might try my hand at patching it to conform closer to the HTTP standards. > Thanks for the help. > > J. F. Miller -- Posted via http://www.ruby-forum.com/.