971994 - Server needs to generate temporary session URIs to send to unregistered users

Status: VERIFIED DUPLICATE of bug 974317

(Hello (Loop) :: Server, defect)

Comment 1

[Byron Campen [:bwc]]

This is the "call-me" URI. Contains information including the caller (this is what allows the client to display who is calling), the callee, an expiry, and an HMAC with some salt. (Do we have tickets for server/client code for serving/fetching these URIs, or is that part of this ticket?)

Comment 2

[Alexis Metaireau (:alexis)]

(In reply to Byron Campen [:bwc] from comment #1)
> This is the "call-me" URI. Contains information including 
> an HMAC with some salt.

Why do we want to have a HMAC and a salt here? What would they be used for?

Comment 3

[Byron Campen [:bwc]]

I think the idea is that we will not be maintaining any list of these URIs server side, so we need to prevent them from being forged, hence the HMAC. I'm not sure about the salt though; we probably need to think that through a little more carefully.

Comment 4

[Alexis Metaireau (:alexis)]

https://github.com/ametaireau/pants-server, and specifically https://github.com/ametaireau/pants-server/blob/master/pants/views.py#L22-L32 is an attempt to solve this.

Associated tests are here: https://github.com/ametaireau/pants-server/blob/master/tests/test_functional.py#L15-L27

Comment 5

[Alexis Metaireau (:alexis)]

This has landed already, it only misses the uuid generation part of the token, which will be taken care of with the patch attached to bug 974317.

Comment 6

[James Bonacci [:jbonacci]]

OK. Verifying as a duplicate.