From 7dc3dbbad1edaac1ac16ef51040f9ff3138fad4e Mon Sep 17 00:00:00 2001 From: Tom Christie Date: Thu, 6 Mar 2014 09:02:46 +0000 Subject: Update docs --- api-guide/authentication.html | 7 +++++-- api-guide/serializers.html | 2 +- topics/contributing.html | 8 ++++---- topics/release-notes.html | 10 ++++++++++ tutorial/4-authentication-and-permissions.html | 2 +- 5 files changed, 21 insertions(+), 8 deletions(-) diff --git a/api-guide/authentication.html b/api-guide/authentication.html index 2265deb1..f8e75399 100644 --- a/api-guide/authentication.html +++ b/api-guide/authentication.html @@ -186,6 +186,7 @@
  • Django OAuth Toolkit
  • Django OAuth2 Consumer
  • JSON Web Token Authentication
    • +
  • Hawk HTTP Authentication
  • HTTP Signature Authentication
    • @@ -268,7 +269,7 @@ def example_view(request, format=None):

    Apache mod_wsgi specific configuration

    Note that if deploying to Apache using mod_wsgi, the authorization header is not passed through to a WSGI application by default, as it is assumed that authentication will be handled by Apache, rather than at an application level.

    If you are deploying to Apache, and using any non-session based authentication, you will need to explicitly configure mod_wsgi to pass the required headers through to the application. This can be done by specifying the WSGIPassAuthorization directive in the appropriate context and setting it to 'On'.

    -
    # this can go in either server config, virtual host, directory or .htaccess 
+
    # this can go in either server config, virtual host, directory or .htaccess
 WSGIPassAuthorization On
 
    
 
    
@@ -285,7 +286,7 @@ WSGIPassAuthorization On

    Note: If you use BasicAuthentication in production you must ensure that your API is only available over https. You should also ensure that your API clients will always re-request the username and password at login, and will never store those details to persistent storage.

    TokenAuthentication

    -

    This authentication scheme uses a simple token-based HTTP Authentication scheme. Token authentication is appropriate for client-server setups, such as native desktop and mobile clients.

    +

    This authentication scheme uses a simple token-based HTTP Authentication scheme. Token authentication is appropriate for client-server setups, such as native desktop and mobile clients.

    To use the TokenAuthentication scheme, include rest_framework.authtoken in your INSTALLED_APPS setting:

    INSTALLED_APPS = (
     ...
@@ -482,6 +483,8 @@ class ExampleAuthentication(authentication.BaseAuthentication):
 
    The Django OAuth2 Consumer library from Rediker Software is another package that provides OAuth 2.0 support for REST framework.  The package includes token scoping permissions on tokens, which allows finer-grained access to your API.
    
 
    JSON Web Token Authentication
    
 
    JSON Web Token is a fairly new standard which can be used for token-based authentication. Unlike the built-in TokenAuthentication scheme, JWT Authentication doesn't need to use a database to validate a token. Blimp maintains the djangorestframework-jwt package which provides a JWT Authentication class as well as a mechanism for clients to obtain a JWT given the username and password.
    
+
    Hawk HTTP Authentication
    
+
    The HawkREST library builds on the Mohawk library to let you work with Hawk signed requests and responses in your API. Hawk lets two parties securely communicate with each other using messages signed by a shared key. It is based on HTTP MAC access authentication (which was based on parts of OAuth 1.0).
    
 
    HTTP Signature Authentication
    
 
    HTTP Signature (currently a IETF draft) provides a way to achieve origin authentication and message integrity for HTTP messages. Similar to Amazon's HTTP Signature scheme, used by many of its services, it permits stateless, per-request authentication. Elvio Toccalino maintains the djangorestframework-httpsignature package which provides an easy to use HTTP Signature Authentication mechanism.
    diff --git a/api-guide/serializers.html b/api-guide/serializers.html index 97cff7b8..2536b149 100644 --- a/api-guide/serializers.html +++ b/api-guide/serializers.html @@ -332,7 +332,7 @@ class EventSerializer(serializers.Serializer): """ Check that the start is before the stop. """ - if attrs['start'] < attrs['finish']: + if attrs['start'] > attrs['finish']: raise serializers.ValidationError("finish must occur after start") return attrs diff --git a/topics/contributing.html b/topics/contributing.html index c9b1956c..6da9761c 100644 --- a/topics/contributing.html +++ b/topics/contributing.html @@ -206,7 +206,7 @@

    The most important thing you can do to help push the REST framework project forward is to be actively involved wherever possible. Code contributions are often overvalued as being the primary way to get involved in a project, we don't believe that needs to be the case.

    If you use REST framework, we'd love you to be vocal about your experiences with it - you might consider writing a blog post about using REST framework, or publishing a tutorial about building a project with a particular Javascript framework. Experiences from beginners can be particularly helpful because you'll be in the best position to assess which bits of REST framework are more difficult to understand and work with.

    Other really great ways you can help move the community forward include helping answer questions on the discussion group, or setting up an email alert on StackOverflow so that you get notified of any new questions with the django-rest-framework tag.

    -

    When answering questions make sure to help future contributors find their way around by hyperlinking wherever possible to related threads and tickets, and include backlinks from those items if relevant.

    +

    When answering questions make sure to help future contributors find their way around by hyperlinking wherever possible to related threads and tickets, and include backlinks from those items if relevant.

    Code of conduct

    Please keep the tone polite & professional. For some users a discussion on the REST framework mailing list or ticket tracker may be their first engagement with the open source community. First impressions count, so let's try to make everyone feel welcome.

    Be mindful in the language you choose. As an example, in an environment that is heavily male-dominated, posts that start 'Hey guys,' can come across as unintentionally exclusive. It's just as easy, and more inclusive to use gender neutral language in those situations.

    @@ -222,7 +222,7 @@
  • Closing an issue doesn't necessarily mean the end of a discussion. If you believe your issue has been closed incorrectly, explain why and we'll consider if it needs to be reopened.

    • Triaging issues

    -

    Getting involved in triaging incoming issues is a good way to start contributing. Every single ticket that comes into the ticket tracker needs to be reviewed in order to determine what the next steps should be. Anyone can help out with this, you just need to be willing to

    +

    Getting involved in triaging incoming issues is a good way to start contributing. Every single ticket that comes into the ticket tracker needs to be reviewed in order to determine what the next steps should be. Anyone can help out with this, you just need to be willing to