defnull/bottle — Issue #299: Bottle should have per request local storage
Author: agnsaft
Created: 2012-03-09 12:07:51+00:00
State: open

Hi,

After some discussion on IRC and Stackoverflow* regarding reuse of request objects (bottle.request) and thread local (bottle.local) there were identified a need for some sort of per request local storage.

Use case:

In my code I validate login tokens (cookies with session ID or similar) in a generic routing at the beginning of each request before control is handed back to the defined route handling procedure. The token validation is implemented as a decorator called @restricted.

In order to separate the generic code and the route handling I have added an attribute to the request object that holds any user information after token validation so I can use this in the route handling procedures later. To remove redundant database lookups I have also added code to check whether this attribute exists in the request object already.

Problem:

Since request objects are reused, validation will only happen once. Depending on the web server, this might even introduce a security vulnerability.

Using bottle.local would fix the problem for my specific implementation, but any multiplexed IO based server (non-blocking server) might treat the bottle.local storage as "global".

Suggested solution:

Adding some sort of request-local storage area that is guaranteed to only be accessible from the current request, no matter web server implementation.

ref: http://stackoverflow.com/questions/9627001/bottle-py-request-object-reuse-object-life-cycle