Question

Let us have some simple page that allows logged users to edit articles. Imagine following situation:

User Bob is logged into the system and is editing long article. As it takes really long to edit such article, his authentication becomes expired. After that, he clicks submit button and because of expired authentication, he is redirected to login page.

It is really desirable to finish the action (saving article) after his successful login. So we shall restore the request that was done while Bob was unauthenticated and repeat it now, after successful login. How could this be done with pyramids?

Answer 1

there are three parts you need;

1. The page that handles the authenticated form submission should check to see if the request is properly authenticated, perform the action, but if it isn’t, store all of the data in a server side session and redirect the use to a login page.
2. The login page should look for a “was trying to do X” sort of query param (eg, ...?fromurl=/post/a/comment. After the user successfully logs in, the login page should redirect the user to that page instead of the site’s front page.
3. The url the user was redirected to should be the same form they used to originally fill out the unauthenticated request. In this case, though, the server should recognize that there are field values stored in the server side session for this user; and so it should populate all of the form fields with those values. The user could then hit submit immediately and complete the post. This could work in a similar way that fields are repopulated when a request contains some invalid form values.

It’s important that step 3 should not perform the post directly; The original data and request came from a user who was not authenticated.