I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles.

Of course, I need to authenticate and authorizate. I wanted to simply ask username and password. My college asked me why not to take login data from file. I answered that I don't want to save password in plain-text. He told me to use tokens!

So how to do it? I understand that I need to generate random token for user and knowing it will allow anyone to login. It should be really strong and random so nobody can guess it. Is there something else? Will it be safe to save it in text file?

I would like to hear how would you implement it in the simplest possible yet secure way. Some links to literature would be good too!

  • Maybe OAuth is best solution for you? It's somewhat complex, but it's standard, it's flexible, and there is ready solutions.
    – cleg
    Jan 14, 2013 at 13:12
  • You write about "complex". I can't believe that it's simplest yet secure solution out there. I'm looking not so much for solution, but for explanation how and why. Thanks for you answer anyway!
    – daGrevis
    Jan 14, 2013 at 13:25
  • I've added a link because OAuth begguiner's guide contains nice introduction with description of problems scope, etc. oauth.net/documentation/getting-started
    – cleg
    Jan 14, 2013 at 13:29
  • 1
    Two out-of-the-box ideas here, both in the "Do One Thing Right" realm. One: ssh-mount the website's data directory locally and just edit files as if they were local (this, of course, only works if you have a filesystem-based backend). Two: install the It's All Text extension for Firefox, configure it to use vim, log into the CMS, select the textbox, activate It's All Text, voila, vim is now your editor.
    – tdammers
    Jan 14, 2013 at 22:26

2 Answers 2


I understand that you are the only person (or one of very few) to use this mechanism:

if you want to authenticate other users of your webapp, then refer to @Martin's answer, otherwise:

your token is technically called a shared secret. It works and it is secure (as long as the secret is not shared to the outside world, like e.g. readable from the web, etc.).
saving it in a text-file is secure if the storage is secure.

another very simple way would be basic auth. it should be sent over ssl, though. see this question for some further discussion on its security implications.


Although you still need a way to authenticate your user the first time (against a hashed password) you can then set a secure cookie that will prove your user is the same one still.

To do this securely, you need a server-side secret, and cookie values that have the time of creation, the username, and that secret hashed together, so that when your user returns for the next HTTP connection you can a) retrieve the username, and b) verify the cookie is still valid and secure.

This is what the mod_auth_tkt Apache module implements, as well as the Pyramid AuthTktAuthenticationPolicy class and the plone.app.session package.

You could take a look through the source code of the latter two to see what they do to create and verify these cookies:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.