Protect all XML-RPC calls with HTTP basic auth but one

Question

I set up a Django project for smartphone serving XML-RPC methods over HTTPS and using basic auth. All XML-RPC methods require username and password.
I would like to implement a XML-RPC method to provide registration to the system.
Obviously, this method should not require username and password. The following is the Apache conf section responsible for basic auth:

<Location /RPC2> AuthType Basic AuthName "Login Required" Require valid-user AuthBasicProvider wsgi WSGIAuthUserScript /path/to/auth.wsgi </Location> 

This is my auth.wsgi:

import os import sys sys.stdout = sys.stderr sys.path.append('/path/to/project') os.environ['DJANGO_SETTINGS_MODULE'] = 'project.settings' from django.contrib.auth.models import User from django import db def check_password(environ, user, password): """ Authenticates apache/mod_wsgi against Django's auth database. """ db.reset_queries() kwargs = {'username': user, 'is_active': True} try: # checks that the username is valid try: user = User.objects.get(**kwargs) except User.DoesNotExist: return None # verifies that the password is valid for the user if user.check_password(password): return True else: return False finally: db.connection.close() 

There are two dirty ways to achieve my aim with current situation:

1. Have a dummy username/password to be used when trying to register to the system
2. Have a separate Django/XML-RPC application on another URL (ie: /register) that is not protected by basic auth

Both of them are very ugly, as I would also like to define a standard protocol to be used for services like mine (it's an open Dynamic Ridesharing Architecture)

Is there a way to unprotect a single XML-RPC call (ie. a defined POST request) even if all XML-RPC calls over /RPC2 are protected?

Answer 1

This may sound like crazy talk, but can your check_password() function see what it needs to do its job, and just return "ok" if the target is the one you wish to unprotect?

I don't know Django at all, so it's possible your check_password() is not even called if there is no username/password if Django catches that before it would call your code.