okfn/webstore — Issue #38: Add an access locking system onto the webstore API
Author: goatchurchprime
Created: 2011-10-10 16:22:30+00:00
State: open

This is so we can control access to the webstore API from scraperwiki, without intercepting (and destroying) its ability to manage and stream large data outputs.

Proposal: Add an validation lock onto the front of the external web API.

Suppose a request comes into scraperwiki onto this place:
https://scraperwiki.com/docs/api#sqlite

with the form ?format=jsonlist&query="select *..."&name=database&attach=anotherdatabase&callback=jsonp&scraperwikiapikey=XXXX

we can parse and authenticate the request in django against the user, apikey and what they are allowed to access.

If it is not allowed, access will be denied

If it is allowed then add a further query_string argument to the request called validation=YYYY where
YYYY=hash([format,query,name,attach,scraperwikiapikey,])
before redirecting the client's request to the webstore.

In webstore (when configured in this way, with the , then the hash is calculated, compared against YYYY, and executed only if it matches.