[Cosmo-dev] JSON-RPC considered harmful

[Brian Moseley]

On 12/5/06, Randy Letness <randy at osafoundation.org> wrote:

> But isn't the path sent as part of the rpc request body?  So you could
> specify another users calendar right?

well that doesn't matter so much given that we are moving to
identifying everything by uid rather than path. but then there's a
similar but different issue that we need to verify the requesting user
has privileges to read/write the identified collection/item.

in the other protocols, we have an acegi voter that checks this for
us. but that voter doesn't get engaged for json-rpc requests. so we're
again back to the original problem. we can put in the temporary fix of
having the rpc layer manually check to make sure the requesting user
is the owner of the item in question. i'm fine with that for 0.6. in
0.7 we can get a real resource-oriented protocol in here that can
participate in the security filtering that the rest of the server
uses.