RESTful Authentication with Tornado

Question

I'm trying to create a RESTful backend for a Backbone.js app in Tornado - creating the resources has been no problem and everything works as I intend. However, I've spent hours scouring the web trying to find some sort of guidance on how to properly handle authentication and session management using this setup. Note that I'm talking about using my own user database, not authenticating users using third-party services like those supported in auth.py.

I'm an extreme novice when it comes to stuff like this, so bear with me. What is the best way going to be to handle authenticating users from Backbone? What should I be returning on the backend upon a successful authentication (i.e., a blank 200, a serialized "status: ok" message, etc.)? What is the proper method going to be for handling authentication requests/responses in Backbone?

Sorry if this is fairly elementary - all the reading I've done has only muddled the issue for me even more.

Answer 1

Looking at the Tornado docs, it looks like you'll just need to populate the current_user property of the RequestHandler after you've authenticated him. Then you'll be able to decorate your protected URLs with the @authenticated decorator. From the backbone.js perspective, a status 200 should work to trigger the next request for content.

Good luck, Sam