[Zope-CMF] Re: ehhh...

[Shane Hathaway]

Tres Seaver wrote:
> 
> Mike Webb wrote:
> 
> > I have a client that does not want any persistant cookies.  Is there a way I
> > can remove the persistant cookie that stores the skin information?  Are
> > there other cookies that are persistant that I may not be seeing?
> 
>   - CMFCore.CookieCrumbler layers cookie-based authentication atop
>     HTTP Basic Auth;  it sets two cookies: (snip)

Just remove the cookie_authentication object and your client will use
HTTP authentication instead.

>   - As you noted, the CMFCore.SkinsTool sets a persistent cookie
>     marking your skin preference.  You could derive a new ZClass
>     from CMFCore.SkinsTool and override 'updateSkinCookie', to change
>     this behavior.

Or you could just modify the "logged_in" skin method to not invoke
updateSkinCookie().

>   - 'personalize' method also sets a persistent cookie, at the time
>     the user selects the skin preference.  This is broken;  it should
>     be asking the skins tool to do this.  You can customize it to
>     suppress this behavior.

Just modify personalize_form and personalize to not allow skin
selection.

(I don't think this is broken.  Cookies are supposed to be a
presentation artifact IMHO, so the skins should be doing all the cookie
handling.  Some of the cookie handling had to move into lower level
objects to accomplish our goals, but only because of ZPublisher
limitations.  If anything, the skins tool ought to know nothing about
cookies, but that's not realistic right now.)

>   - The 'folder_contents' and 'folder_filter_form' methods set persistent
>     cookies to represent the "view filter" state;  again, customization
>     is the quickest route to changing this behavior.

To summarize:

- Delete the cookie_authentication object from your portal.

- Customize logged_in, personalize_form, personalize, and
folder_contents.

> Hope that helps.  I would entertain a tracker issue proposing
> making all persistent cookies optional. :)

We could just create another skin layer, "no_cookies", if enough people
want this.

Shane