Lazy sessions and authorization (Drupal)

[Cantor, Scott]

On 11/5/13, 3:34 AM, "Laas Toom" <Laas.Toom at ut.ee> wrote
>
>You are fixating my contrived example and telling me that the app is
>wrong.

I'm really trying to grasp the distinction between basic-auth and this
case, because that helps me understand, and it did help me to see that
what you really were talking about was suppressing the visibility of the
user information, which is something that basic-auth does *not* allow.
You're either logged in or not, so the difference is that there's no such
thing as a lazy session to begin with. It's not really a clean comparison.

>I can see that conditionally not exporting data is both technically
>difficult to implement and questionable from usage point of view
>(considering how hard it is for me come up with plausable example). ;-)

I think Peter's suggestion may have been the best one. If you somehow want
to turn "not authorized" into "no session", the simplest way you can do
that is with the Attribute Checker sessionHook that can dump the session
if it doesn't meet your policy. That seems to give you what you're looking
for, provided that the policy is actually the same for every case and
every session that gets created.

>Thank you for your patience and explanations,

Thank you,

-- Scott