proper usage of exclusive_domain = True ?

[vapirix]

So I'm attempting to set up the usage scenario of:

domain1.com -> load app 1
domain2.com -> load app 2
etc. etc.

I need domain1 to NOT have access to app 2, 3, 4, 5, etc.

That all works using the router's "domain" settings. Obviously you run
into the problem of: domain1.com loads app1, but domain1.com/app2
loading app2, so I use "exclusive_domain = True", and then I have to
do domain1.com/app1/ to load the app without raising an exception,
which seems counter productive. Besides that, even with
exclusive_domain = True, I can do domain1.com/app2 to load the second
app. Is there any way to do what I'm attempting to do here? I'd rather
not have to set up separate web2py installs for the tons of tiny apps
I do for my clients that get 1 hit every 6 months.

What can I do here, friends?

[vapirix]

OR can maybe somebody point me in a different direction to achieve the
same thing without a hilariously complicated config process that I
won't want to do every time? =)

[Jonathan Lundell]

Sounds like a bug in exclusive_domain. I'll look at it when I get home later.

[vapirix]

That would be truly excellent.

It would change the way I do a lot of stuff. Right now I am forced to
use php for a lot of small little apps that I don't want to surrender
an entire web2py install for. =D

On Aug 17, 4:01 pm, Jonathan Lundell <jlund...@pobox.com> wrote:
> Sounds like a bug in exclusive_domain. I'll look at it when I get home later.
>

[Jonathan Lundell]

On Aug 17, 2011, at 4:29 PM, vapirix wrote:

> That would be truly excellent.
>
> It would change the way I do a lot of stuff. Right now I am forced to
> use php for a lot of small little apps that I don't want to surrender
> an entire web2py install for. =D

The problem is that exclusive_domain is enforced for URL(), but not for incoming requests. That's actually how it's documented:

> # exclusive_domain: If True (default is False), an exception is raised if an attempt is made to generate
> # an outgoing URL with a different application without providing an explicit host.

It's easy to extend to incoming apps, but I'd like to be sure of the rule that gets enforced. I think the rule should be: if exclusive_domain is True for a given app (either because it's set True in the base router or in an app-specific router), then that app will only recognized if the incoming domain (and possibly port) matches one mapped to that app in the domains dictionary. If it doesn't match, we'd raise a 400 invalid request/invalid application error.

BTW, you can share a web2py installation across completely separate app installs, by creating a separate applications/ directory for each app, and starting web2py with the --folder option, once for each app. I'm not sure how you'd configure wsgi for this kind of thing, but it'd be easy enough (I think) with mod_proxy.

[vapirix]

I read that in the documentation, but it was JUST ambiguous enough
that I thought it might work for my uses. I can't imagine a time when
I would want to limit it in the URL helper without also limiting the
incoming URLs. It seems like an also-intended functionality. =)

If it isn't, it would be great to have a different flag we could use
in the domain router to do what I'm intending here. I can't be the
only person who would find it useful, haha. It would just map domain -
> app, always leave out the app name in the URL, and not allow access
to other apps.

And unfortunately I'm using wsgi, and I have no idea how I would go
about setting up your separate application directory idea. If anybody
DOES know, I'm all ears. =)

[Jonathan Lundell]

On Aug 18, 2011, at 8:36 AM, vapirix wrote:

> I read that in the documentation, but it was JUST ambiguous enough
> that I thought it might work for my uses. I can't imagine a time when
> I would want to limit it in the URL helper without also limiting the
> incoming URLs. It seems like an also-intended functionality. =)

I regard it as a bug in both the code and the documentation that needs to be fixed.

[Jonathan Lundell]

I'm looking at this logic a little more closely, and it seems to me that the current code is wrong in a way that doesn't have to do with enforcing exclusive_domain. It's easy to fix, but I wonder if someone is relying on the wrong behavior.

The problem is this. Suppose you enable domain routing thus:

domains = {
"domain1.com" : "app1",
"www.domain1.com" : "app1",
"domain2.com" : "app2",
}

Right now, domain2.com/app1 will load app1 because the code recognizes app1 as an app, and that takes priority over the domain. But that's a bug. It *should* load app2 because the domain specifies it. And in that case, "app1" in the URL will be most likely interpreted as a *function*, as it should, I believe.

That is, the domain should take priority in app determination if the domain is in the domain map, meaning that we don't really care whether "app1" happens to be the name of an app in another domain. So (unlike what I said the other day), this does not immediately result in an exception. It probably *will* result in an invalid-function exception, but that's just normal processing.

And that's why exclusive_domain is only a check on output. In fact, I'm wondering if it should be the default (or not there at all, but rather always true).

[Jonathan Lundell]

On Aug 16, 2011, at 3:07 PM, vapirix wrote:

Please try the current trunk.