Re: We need another Auth

le 10/06/02 14:06, Martin Jansen à mail@martin-jansen.de a écrit : > On Mon, 10 Jun 2002 10:49:42 +0200, Bertrand Mansion wrote: > >> I have had so much difficulties to adapt Auth to my own need. The class is >> not flexible enough and might be good for a very basic authentication system >> but not for a complete web application. >> >> I think we need a better authentication system. > > That's a very nice thought. If one feels like he is in the position to > say something like this, he should come up with a definitive plan that > tells *what* to improve. Simply busting out that something needs to be > changed is a bit poor. So what do you want to change in detail? Make a > list of the things that need to be changed practically. Provide patches > for the existing system. Do something constructive. I knew you would react like that :-) I am not saying Auth is bad, I just say it is not complete enough and the way it is designed now doesn't allow for changes to be made without a complete rewrite, IMO. Auth is good enough for simple authentication systems and does the job well when it comes to that only. I spent all the morning trying to explain my thoughts in the numerous mails I have sent (9), I am trying to be constructive. > If someone (Markus?) comes up with good improvements, I'll have nothing > against merging them into Auth. I'll even not object against replacing > Auth with something better if the changes are reasonable and BC will be > kept. But simply writing that Auth needs to be dropped in favour of > something better isn't very acceptable yet :). We probably won't have to replace the current Auth class. It just depends if Markus'class does the same in a better way and if the APIs are compatible or not. If the APIs are different, then we will probably need to have two Auth classes which I have nothing against as long as they have different names. There are more than one html form class in pear, there are more than one template class in pear... >> This morning, I indexed 35 000 pages using htdig on a website I run >> (http://cocoa.mamasam.com). The indexing crashed because of the way Auth >> handles sessions. I don't understand why there is a session_start() in the >> class start() method. This will start a new session everytime htdig accesses >> a new page. I ended up with 35 000 session files in the session directory ! > > As far as I see, htdig is fucked up then, no? Right. I am a bit fucked up too, but I will fix that some day. Bertrand Mansion Mamasam