From: Kent Dahl <kentda@...>
Date: 2002-10-23T15:38:59+09:00
Subject: Re: XMLRPC and IP authentication

Daniel Berger wrote:
> I want to implement some very basic security for an XMLRPC server.  My
> first filter was going to be to restrict access by IP address.  Is there
> a way to snag the client's IP from an XMLRPC::Server object from wthin a
> service hook?  I listed the object methods, but nothing stood out at me.

I seem to recall subclassing XMLRPC::Server and implementing some checks
in request_handler, to do the above (and later, to add basic
authentication).

It went something like this:
<SNIP>
 def request_handler( req, resp )
        caller_address = req.data.peeraddr[2] 
        if @allow.include?( caller_address )          
          super req, resp
        else
          response.status = 405
        end
      end
</SNIP>
before I switched to authentication.

HTH

-- 
(\[ Kent Dahl ]/)_    _~_    __[ http://www.stud.ntnu.no/~kentda/ ]___/~
 ))\_student_/((  \__d L b__/  NTNU - graduate engineering - 5. year  )
( \__\_�|�_/__/ ) _)Industrial economics and technological management(
 \____/_�_\____/ (____engineering.discipline_=_Computer::Technology___)