Hi Manu,

This is by default handled by the controllers, which have an option to only allowed logged in users for example. In your case it would look like this:

class YourController(openerp.http.Controller):
    @route('/page/sample', auth='user')
    def your_function(self):
        return stuff()

 By default there are three types of controllers, with specific rights attached to them:

• user: The user must be authenticated and the current request will perform using the rights of the user.

• public: The user may or may not be authenticated. If she isn't, the current request will perform using the shared Public user.
• none: The method is always active, even if there is no database. Mainly used by the framework and authentication modules. There request code will not have any facilities to access the database nor have any configuration indicating the current database nor the current user

 For more information about controllers see this documentation: https://www.odoo.com/documentation/8.0/reference/http.html

Yenthe