title: Web application Kerberos authentication: Is the proper way to combine with cookies?
body: <p>The scenario:</p>
  
  <ul>
  <li>An enterprise, behind-the-firewall Python web application.</li>
  <li>Kerberos should be used to authenticate the users.</li>
  <li>I have working code that sends the correct responses from the server (the <code>Negotiate</code> header etc.) and get the Windows user name of the user accessing the application, using the <code>kerberos-sspi</code> package</li>
  </ul>
  
  <p>I have little experience with Kerberos, but some experience with web applications.</p>
  
  <p>In other Python web apps I have created that use a built-in user database, the authentication flow is typically as follows:</p>
  
  <ul>
  <li>For each request, check if the request has a (signed) cookie containing the user id (or some variation - for instance using flask-login where the user id is stored in <code>flask.session</code>)</li>
  <li>If the cookie exists, respond normally.</li>
  <li>If the no such cookie exists, redirect to <code>/login/</code> displaying a username/password form. <code>POST</code> to <code>/login/</code> verifies correct username/password, sets the secure cookie and redirects to the URL specified in the <code>?next=</code> query param.</li>
  </ul>
  
  <p>My question is:</p>
  
  <ul>
  <li>In the Kerberos-authenticated web app, is the authentication flow similar?</li>
  <li><p>I.e. should I do the following:</p>
  
  <ul>
  <li>For each request, check if the request has a (signed) cookie containing the user id</li>
  <li>If the cookie exists, respond normally.</li>
  <li>If the no such cookie exists, redirect to <code>/login/</code>. <code>/login/</code> does the necessary stuff to figure out who the user is (i.e. sending the <code>Negotiate</code> header, use <code>kerberos_sspi</code> to find the user name etc.), then set the secure cookie and redirect to the URL specified in the <code>?next=</code> query param.</li>
  </ul></li>
  <li><p>Or should it be handled some other way?</p></li>
  </ul>